Closing an HTML tag without using the actual character

Question

I'm currently learning how to perform XSS on websites, but there is a constant problem that keeps recurring that I'm sure must be easy to bypass. Quite often, the website will filter out quotation marks and/or "< >". This is not a huge problem when it comes to the actual script, as that can be bypassed by using a different method or by obfuscating the script, the real problem is when I need to escape from an HTML tag. For example:

<input class="user-control-search-textbox" type="text" name="tx_indexedsearch[sword]" value="onmouseover='javascript:alert(0)'" id="tx-indexedsearch-searchbox-sword" />

As you can see, the javascript won't execute because it is inside the quotations for value, and therefore is not treated as executable code but as an actual search. The problem is that I cannot get it to escape from this as when I put in "> it turns into

value="">onmouseover='javascript:alert(0)'" 

and so the tag is not closed as the actual character isn't used.

What I would like to know is if it is possible to close the tag without using the actual character (in this case " and >) as they are filtered out, or whether I can obfuscate the character in some way but still have it read as closing the tag.

If anyone can help me then I thank you very much, it is probably a stupid question.

Answer 1

Not in general, no.

Attacks at the encoding level like UTF-7 work by specifying ASCII characters to produce byte content that is interpreted very differently by tricking a browser's encoding guessing heuristics, but most modern browsers are savvy to that sort of thing.

If the page ends up being processed by a buggy mobile gateway, language translation service, or other system that tries to be helpful by converting non-ASCII characters to ASCII "equivalents", then full-width versions like ＞ might be converted to >.

Answer 2

See http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#attribute-value-(double-quoted)-state , which describes how HTML parsing works in a very detail level.

It says that nothing except " or & can get the html parser state changed from attribute-value to other state.