Check which characters are converted by the web server

intigriti_xss_check.py

import re
import string

import requests


def check(c):
    t = requests.get(f'https://challenge.intigriti.io/{c}').text
    return re.match(r'404 - \'File "(.*?)" was.*\'', t).group(1)


chars = string.punctuation + string.ascii_letters
chars = re.sub(r'[#/%]', '', chars)
result = dict(zip(chars, re.findall(r'_..|.', check(chars))))

stripped = [c for c, m in result.items() if c != m]

print(stripped)