insert into board: script -> set url location: rhine1.site/shop#URLENCODE{} fragment gets added to innerHtml, image onerror executes example: paste cookie in developer tools: s:hb1XF3Cy37MqRVhewjDdi-dX7UC7vHiM.5oZAUJT5TCFaSLCVlZYiAlh/9TsGF62Vnq5hBjop+08