### TL;DR
We achieve cross-site-scripting by embedding javascript in our profile picture header. We report ourselves to the admin, which requests and parses their profile for the flag. This is submitted to us and ready for us to submit and claim our points.