misc-杰斯的魔法

题目

 

 明显是js代码，构造xss攻击

用phpstudy自己建一个网页，放在www下面

 

 然后构造

http://localhost/1.php?id=document.write(unescape(%27%3Cscript%20language%20%3D%20%22javascript%22%3Ealert%28%22moctf%7Bscr1pt_1s_magical%7D%22%29%3B%3C/script%3E%27));

 

 

moctf{scr1pt_1s_magical}