HttpOnly Is Not an XSS Sandbox
CookieBank fixed its session cookie with HttpOnly, but the reflected XSS remains. JavaScript can no longer read the authentication cookie directly. Test whether malicious same-origin JavaScript can still act as the logged-in user.
Objective
Use XSS to fetch the authenticated private-note endpoint and recover its flag even though document.cookie cannot reveal the session.