xss3.ctf.tamu.edu
The filtering is perfect this time, really! You know the drill; the client's cookie contains your flag.