XSS Challenge

Rules

1. Execute alert(origin) on each challenge origins (challenge-hamayan.quiz.flatt.training, 34.171.202.118, challenge-kinugawa.quiz.flatt.training).
2. You must exploit XSS in each challenges.
3. Unusual user interactions are not allowed, the exploit must execute alert(origin) when you open a link.
4. You can refer to the source code for each challenge.
5. Once you solved the challenge, please submit the answer via Google Form. Please explain in writing how you solved the challenge.