XSS payload without - &<>"=()

Question

Is it possible to construct a XSS payload without the use of these chars - &<>"=()? The server is not doing any output encoding.

Consider both the cases where the user input is being put into 1. attribute value, 2. HTML body.

Answer 1

@Arminius covered it pretty well. But there are exceptions depending on the HTML attribute. Here are just two examples (others exist, mostly related to URLs, but onX and some other attributes are also special cases; additionally, with the use of JS frameworks script gadgets may also be used).

href attribute:

// user-supplied link:
<a href="[user_input]">click</a>

attack:

javascript:alert`1`

meta attribute:

// user-supplied link for redirect:
<meta http-equiv="refresh" content="0;url=[user_input]">

attack:

data:text/html;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg

Answer 2

Generally, no. At least not without preconditions (some of which @tim has lined out), because:

• You can only escape from an attribute value by introducing the matching quote. (I assume you're referring to a double-quoted attribute, so a payload without " doesn't get you beyond the attribute value. Obviously, you could escape from a single-quoted attribute because ' isn't blacklisted, or from an unquoted one by using a space.)

• In the data state (outside of any tags) you can only achieve XSS by introducing new tags. Everything else is just treated as data. So if < is blacklisted, you're out of luck.