I tried to get reflected XSS in vulnerable website with a request to the following URL:
https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)>
The browser URL encode the chars and it is also reflected back in the response encoded, so it doesn't work. But if I intercept the request and type the payload without encoding the XSS is executed.
Is there any way to send the request without the browser encoding it?