> For the complete documentation index, see [llms.txt](https://hacker-mind.gitbook.io/hacker-mind/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacker-mind.gitbook.io/hacker-mind/penetration-testing-notes/web-application-80-443/xss.md).
# XSS
## Encode by htmlspecialchars
Try this payload first, to identify which the chars that encoded:
```
!@#$%^&*()}{\'\"|?><`~}
```
Tips:
> Look at other reflected in the html code, maybe in the tag \
```
event `message` mean that the web application receive the message from method postMessage
so we can use iframe to interact with the web application via postMessage
create a web hook with this payload
```
Test