Challenge

A newsletter signup with an admin bot reviewing submissions. Unlike most XSS bot challenges, there was no sanitization and no cookie to chase, the bot simply triggering script execution was the win condition.

Approach

The most boring payload on the board:

1

<script>alert(1)</script>

Submitting that fired the alert in the bot’s context and returned the flag directly.

Flag

HTB{p0pp3d_th3_4l3r7_r34l_e4sy!_695d02352e8c70d53df5070a5aa7166d}