XSS vector with space after less-than sign [closed]

Question

I need XSS that works with a space after the less-than sign (<).

Input: < img src=x onerror=alert(1)>

Output: < img src="x" onerror="alert(1)">

Answer 1

That's not possible.

The HTML5 syntax specification requires a lower-case or upper-case ASCII letter after an opening angle bracket.

Here's the HTML5 tokenizer state after a < (the "Tag open state"):

Consume the next input character:

"!" (U+0021)
    Switch to the markup declaration open state.
"/" (U+002F)
    Switch to the end tag open state.
Uppercase ASCII letter
    Create a new start tag token, set its tag name to the lowercase version of the current input character (add 0x0020 to the character's code point), then switch to the tag name state. (Don't emit the token yet; further details will be filled in before it is emitted.)
Lowercase ASCII letter
    Create a new start tag token, set its tag name to the current input character, then switch to the tag name state. (Don't emit the token yet; further details will be filled in before it is emitted.)
"?" (U+003F)
    Parse error. Switch to the bogus comment state.
Anything else
    Parse error. Switch to the data state. Emit a U+003C LESS-THAN SIGN character token. Reconsume the current input character. 

As you can see, only characters in [a-zA-Z] will make the tokenizer emit a tag token, that is, open an actual tag. Anything else will just turn the bracket into a literal < and not be XSS-able in any browser that adheres to the specification.

Answer 2

Why not try url encoding %20 a space? There are other encoding options that might satisfy this as well, such as base10 or base64 encoding that you can try.