I'm currently learning how to perform XSS on websites, but there is a constant problem that keeps recurring that I'm sure must be easy to bypass. Quite often, the website will filter out quotation marks and/or "< >". This is not a huge problem when it comes to the actual script, as that can be bypassed by using a different method or by obfuscating the script, the real problem is when I need to escape from an HTML tag. For example:
"> it turns into
and so the tag is not closed as the actual character isn't used.
What I would like to know is if it is possible to close the tag without using the actual character (in this case
>) as they are filtered out, or whether I can obfuscate the character in some way but still have it read as closing the tag.
If anyone can help me then I thank you very much, it is probably a stupid question.