I think it is safe to say at this point that there is no trivial/text-book bypass for this filter using a modern browser. I shared this snippet of code with a group of friends and colleagues who I consider proficient in XSS and none of them could construct a bypass.
Answer from EdOverflow on Stack ExchangeVideos
I think it is safe to say at this point that there is no trivial/text-book bypass for this filter using a modern browser. I shared this snippet of code with a group of friends and colleagues who I consider proficient in XSS and none of them could construct a bypass.
You can try the encoded character equivalent to what you are trying to input. Try using URL encoding on the payload portion of your input to bypass this filter.
For instance, you can URL encode "=" to %3D or URL encode <img src=x onerror=alert(0)> to %3Cimg+src%3Dx+onerror%3Dalert%280%29%3E
This will bypass the filter if it is expecting "="
Alternatively, since it looks like you are running this on your localhost, use a proxy tool such as Burp Suite to intercept your requests/responses, you can play around with different payloads to test your XSS payloads.
Contrary to what is being said in the accepted answer, jQuery.html() and the many jQuery functions which accept HTML strings as arguments are more prone to DOM-based XSS injection than innerHTML, as noticed by the OP.
jQuery.html() extracts the <script> tags, updates the DOM and evaluates the code embedded in the script tags.
As a result, XSS can happen without user interaction even after the DOM is loaded when using jQuery.html().
This is very easy to demonstrate.
This will call alert():
$('.xss').html('<script>alert("XSS");</script\>');
http://jsfiddle.net/2TpHC/
While this will not:
var d = document.getElementById('xss');
d.innerHTML = '<script\>alert("XSS");</script\>';
http://jsfiddle.net/Tjspu/
Unfortunately, there are many other code paths (sinks) which lead to calling eval() in jQuery. The security conscious will probably avoid jQuery altogether, as far as possible.
Note that I do not claim that using innerHTML is an effective defense against XSS. It is not. Passing unescaped data to innerHTML is not safe, as pointed out by @daghan. One should always properly escape data when generating HTML.
JQuery strips out the script tags, which is why you aren't seeing it append to the dom let alone executing.
To see an explanation of why jquery strips it out, you can see John Resig's reply here: https://forum.jquery.com/topic/jquery-dommanip-script-tag-will-be-removed
Hope this helps