Reflected in the Search Box
HackerMart's real product-search route reflects the q parameter into its result heading. Test the hosted target with normal requests and determine whether the response treats your search term as text or markup.
Objective
Fire an alert box by injecting a script into the search box.