Tags: web 

Rating:

bypass waf to execute js and steal flag in cookie

Original writeup (https://thegoonies.rocks/google-ctf-final-destination-web/).