Rating:
## [Original/Source Writeup](https://bigpick.github.io/TodayILearned/articles/2020-10/b01lersbootcamp#reindeer-flotilla)
The website is just a simple page that echos back whatever we input in a text field.
From the description, we need to execute XSS. However, `<alert>` is blocked and not able to be entered into the box. Google searching for XSS alternative payloads to circumvent filtering, we find this [XSS filter evasion cheat sheet](https://owasp.org/www-community/xss-filter-evasion-cheatsheet).
In the page, we find the following payload:
We are allowed to post this in the box, and when moused over, successfully triggers the XSS dumping the cookies (followed by our flag).
Flag is `flag[y0u_sh0uldnt_h4v3_c0m3_b4ck_flynn]`
