1. Markdown formats rich text (headers, bold, emphasis) with hyperlinks and images — and on real sites (GitHub, Hacker One-style platforms) that text is user input.
2. Marker first: submit **Udemy123** and look where it lands. Then get curious about the two constructs that carry attributes: links [text](url) and images ![alt](src).
3. The URL scheme is the vector: javascript: inside a link is script the browser is happy to run on click.
4. Syntax grammar decides the payload: this parser accepts ONE level of parentheses (alert(1) is fine) — nested alert((1)) or an unbalanced ) breaks the link into plain text. Adapt, don't paste.
5. A markdown XSS cheat sheet is a starting list, not a strategy — pick the approach, then read what failed and why.

The classic:

[click me](javascript:alert(1))

Backtick variant (no parentheses at all — immune to the paren grammar):

[click me](javascript:alert`1`)

Broken on purpose (so you learn the rule): [x](javascript:alert((1))) or any unbalanced ) — the markdown stops matching and the raw text renders instead. And the parser filters nothing about the scheme — that's why it's called permissive.