0

This question already has an answer here:

I'm wondering if xss is possible without these chars

disallowed/filtered text: < > ! @ # $ % ^ & * : ? = ( )

I'm able to break out of a style attribute of an element by introducing an ending quotation mark. I can do stuff like inject a keyword like onerror in the dom, but I can't use = or anything to create my own src attribute (I can get src into the dom, but I can't assign the src attribute) or something.

marked as duplicate by Steffen Ullrich, schroeder May 1 at 8:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Browse other questions tagged or ask your own question.