The Readable Session Cookie
CookieBank has a reflected XSS bug in transaction search. Its session cookie is set without HttpOnly. Test the real search route and determine what an injected script can read from the browser's cookie jar.
Objective
Use the reflected XSS to read the session cookie and recover the flag stored in it.