tl;dr

• use hash extension to bypass password check on login.
• use RSA properties to recover $q$ and get $p$ and therefore $N= p*q$.
• sign the message given, and get the flag.

tl;dr

• XSS using DOM Clobbering
• <a id="showInfos"></a><a id="SETTINGS" name=check data-timezone="aaa" data-location="eval(window.name)"><a id="SETTINGS" name="x">
• Bypass CSRF protection to execute XSS and read flag.