Challenges do NOT require any bruteforcing/directory fuzzing/massive amounts of traffic unless clearly specified in the challenge information below.
You'll have to somehow get XSS.
May be by stopping something? May be by abusing unexpected behaviour of browser? May be by fuzzing?
All upto you.
Note : Intended solution works in Firefox only. Solutions working on outdated browsers will not be accepted.