I'm wondering if xss is possible without these chars
disallowed/filtered text: < > ! @ # $ % ^ & * : ? = ( )
I'm able to break out of a style attribute of an element by introducing an ending quotation mark. I can do stuff like inject a keyword like onerror in the dom, but I can't use
= or anything to create my own src attribute (I can get src into the dom, but I can't assign the src attribute) or something.