1. Send XSSHunter payload.
2. View secret cookie in XSSHunter.

Original writeup (https://www.bad5ect0r.sh/index.php/2020/03/09/utctf-2020-chatt-with-bratt/).