Please, do not write just a link to original writeup here.

[https://www.alevsk.com/2018/06/security-fest-ctf-excess-write-up-xss/](https://www.alevsk.com/2018/06/security-fest-ctf-excess-write-up-xss/)

Original writeup (https://www.alevsk.com/2018/06/security-fest-ctf-excess-write-up-xss/).