# XSS
## Encode by htmlspecialchars
Try this payload first, to identify which the chars that encoded:
```
!@#$%^&*()}{\'\"|?><`~}
```
Tips:
> Look at other reflected in the html code, maybe in the tag \
```
event `message` mean that the web application receive the message from method postMessage
so we can use iframe to interact with the web application via postMessage
create a web hook with this payload
```
Test