N/A

Rules:

This challenge runs from 27/07/2026 10:00 AM until 03/08/2026, 11:59 PM UTC.

• Out of all correct submissions, we will draw seven winners on Wednesday 05/08/2026:
  • First blood
  • Three randomly drawn correct submissions
  • Three best write-ups
• Every winner gets a €50 swag voucher for our swag shop
• First blood receives a €100 swag voucher!
• The winners will be announced on our X profile.
• For every 100 likes, we'll add a tip to announcement post.
• Join our Discord to discuss the challenge!

The solution:

• Should leverage a XSS vulnerability on the challenge page.
• Shouldn't be self-XSS or related to MiTM attacks.
• Should work in the latest version of Google Chrome.
• Should include:
  • The payload(s) used
  • Steps to solve (short description / bullet points)
• Should be reported on the Intigriti platform.

Get started:

1. Test your payloads on the challenge page & let's capture that flag!

N/A

This program follows Intigriti's triage standards based on the proof of concept.

Am I allowed to collaborate?

Yes! Be sure to join our official Discord server if you wish to find friends to collaborate with.

How can I enter the write-up contest?

If you wish to enter the write-up contest, we require you to write a write-up of your solution. This write-up can be published on any blogging or hosting platform of your desire (e.g., GitHub pages/Gist, Medium, Hashnode, self-hosted blog, etc.).

Please note that we cannot accept PDF or Markdown files, and will always need a publicly accessible link to your write-up.

I have my write-up. Where can I submit it?

You can submit your write-up by simply adding the link as a comment under your report. Be sure to mention us as well so we get notified.

Important note: Please hold off from making your write-up publically accessible just until the challenge ends, and no new submissions are accepted. This is to keep it fair for everyone, thank you! You can track the challenge's progress through the challenge page!