Same here. Unless there's some steganography, I'm really all out of ideas. I see see the content of folders (/static/, /static/images/, etc), but that doesn't help. I can't get anything out of /admin and the content of /post don't appear anywhere for any sort of XSS attack.

There isn't any steganography (at least for the flag that I found). They have a bot that actually "reads" your post, which you can verify for yourself. This is alluded to in the message that you get when submitting a post:

> Your post was submitted for review. Administator will take a look shortly.

> which you can verify for yourself

How can you verify? That's what I was stuck, it's hard to test things if you're not getting any sort of feedback. That message seemed pretty constant.

EDIT: I see, managed to verify it by putting an image on my own webserver and seeing the log hit. I got a rough idea now, thanks!

EDIT2: Got it :)

I completed the challenge. You don't need to see the result of the entry to deduct if XSS is possible.

If the server is parsing your input, maybe you can find a way for the server to leak more than it wants.

If you want more information, or simply the answer, PM me.

Hi, could you provide some more information regarding how one can force the server to leak more information than it should? I have been stuck with this exercise for quite some time and am honestly out of ideas.