Acme Card (DOM XSS)

web · medium · 250 pts

Acme Card reads from URL fragment client-side. Server-side filters can't see it. Get the admin bot to leak its cookie. --- ### Run locally ```bash cd content/aysec/AYSEC-CTF docker compose up dom-xss ``` Then open `http://localhost:8000` and start solving.