Note that we didn't solve this challenge. If you want to see the solution directly please see

- [@trichimtrich's svg XSS](https://twitter.com/trichimtrich/status/1173492135993073664)
- [@stereotype32's utf-16 payload](https://twitter.com/stereotype32/status/1173422028847599616?s=21)

Original writeup (https://balsn.tw/ctf_writeup/20190913-realworldctfqual/#hcoream-(unsolved)).