js4

i need a push in teh right direction here. are we doing the ol' javascript injection into the url?B)

Yeah, it has to do with the url, but it's not javascript injection. Click the button and look at the url. Now, seeing that think about XS*

i know nothing about xs so could you help me out

XSS, look it up. If you still can't find a good article after a while of looking, PM me and I'll send you a link to a good article. But, as it says, the challenge is down right now (that's not part of the challenge, it's really down).