tl;dr

• Leak csrf token bypassing document.domain
• visiting /profile/ will not change the nonce
• Leak nonce using dangling markup in firefox
• Add XSS payload using the csrf to get the flag