I'm currently learning how to perform XSS on websites, but there is a constant problem that keeps recurring that I'm sure must be easy to bypass. Quite often, the website will filter out quotation marks and/or "< >". This is not a huge problem when it comes to the actual script, as that can be bypassed by using a different method or by obfuscating the script, the real problem is when I need to escape from an HTML tag. For example:
<input class="user-control-search-textbox" type="text" name="tx_indexedsearch[sword]" value="onmouseover='javascript:alert(0)'" id="tx-indexedsearch-searchbox-sword" />
As you can see, the javascript won't execute because it is inside the quotations for value, and therefore is not treated as executable code but as an actual search. The problem is that I cannot get it to escape from this as when I put in ">
it turns into
value="">onmouseover='javascript:alert(0)'"
and so the tag is not closed as the actual character isn't used.
What I would like to know is if it is possible to close the tag without using the actual character (in this case "
and >
) as they are filtered out, or whether I can obfuscate the character in some way but still have it read as closing the tag.
If anyone can help me then I thank you very much, it is probably a stupid question.