ServiceWatch lets users submit services for the internal team to list. Every submission is reviewed by an admin before publishing.
Your goal: a flag lives in the admin's cookies once they're logged in. You can't log in as admin and can't XSS this landing page directly - the only thing you influence is the service name you submit, which the admin's review page renders.
Local testing tip: a simple exfiltration collector is available at
POST /collect (and GET /collect to view what
it received) so you can test cookie exfiltration without any external
service.