Please, do not write just a link to original writeup here.
[https://www.alevsk.com/2018/06/security-fest-ctf-excess-write-up-xss/](https://www.alevsk.com/2018/06/security-fest-ctf-excess-write-up-xss/)