SearchGrid reflects the query back in the results banner. Nobody escaped the output before sending it to the browser. The session cookie is exposed in the page's JavaScript scope.
practice grid — every target is a toy in your own browser. this is not an invitation to test the real site.
enter flag