I'm wondering if xss is possible without these chars

disallowed/filtered text: < > ! @ # $ % ^ & * : ? = ( )

I'm able to break out of a style attribute of an element by introducing an ending quotation mark. I can do stuff like inject a keyword like onerror in the dom, but I can't use = or anything to create my own src attribute (I can get src into the dom, but I can't assign the src attribute) or something.

Browse other questions tagged or ask your own question.