Loading page
Review the challenge brief, files, and requirements.
The search functionality on this page reflects user input without sanitization. The flag is stored in a cookie called secret_flag. Craft an XSS payload that executes JavaScript to alert the flag cookie.
Sign in to attempt this challenge.
Use Proving Grounds to continue your challenge practice.
Open Proving Grounds