# Full WriteUpFull Writeup on our website: [http://www.aperikube.fr/docs/easyctf_2018_fumblr/](http://www.aperikube.fr/docs/easyctf_2018_fumblr/)
-----
# TL;DRAfter finding a XSS, I manage to bypass the CSP using the raw post functionality. Then I made a payload to exfiltrate admin’s hidden posts to my blog.