Web - Client

I have xss on the site, but I am not getting what to do next. I tried evaluating the FLAG_REDACTED but that did no help, no result.

What does this ’Only bot can view’ mean here ? hidden tags ? accessing varable ?

If accessing variable then I am having hard time fitting it inside alert

It means only a bot on the server may evaluate the FLAG_REDACTED. If you know what CSP is all about you may get a clue on what to do to take advantage of it.

yeah same problem, thx for the tip, anyway what is the best source on CSP ? is it "CSP Is Dead, Long Live CSP" ?