[hhaidar]

* MORE SPOILERS! *

#6 looks like: https://xss-game.appspot.com/level6/frame#//rawgit.com/hhaid...

[thekos]

This works also, and doesn't require a hosted file: https://xss-game.appspot.com/level6/frame#data:text/plain,al...

[mpetrov]

Also just putting a space in front of https:// works, the script tag handles the leading space just fine.

[dvirsky]

Even simpler - Https://

[alttag]

Don't know that's it's necessary to put the spoiler here. The hints provide an alternative to hosting a file.