BugBountyHunter

Solution: data:text/html,<iframe name="<svg onload=alert(document.domain)>" src=https://www.bugbountytraining.com/challenges/challenge-6.php?url=javascript:name>

When using the javascript pseudo scheme, if the returned value is a string, browsers will write it onto the page like document.write. This is why some bookmarklets have a void(0) at the end to prevent the results accidentally return a string.

Another thing to know is the window.name property persists even after navigation, and we can control this value.

So, we can assign window.name with a XSS payload in HTML, then use javascript:name so that it writes the payload onto the page.