about XSS challenge I found the admin page.
It uses phplist version vulnerable to SQLI&XSS
I understood I have to enter with admin and then use XSS POC from exploitdb
I am tried brute force with rockyou wordlist but It requires more more time to give a result.
Could you indicate me if I follow the correct way? What wordlist do you suggest to use?