3 ms·
I've managed fourteen so far, though on a couple, their counter made it challenging to determine which event is firing. Much of the fun is creative use of comm
by cjcampbell 5y ago
I've managed fourteen so far, though on a couple, their counter made it challenging to determine which event is firing.
Much of the fun is creative use of comments, quotes, and new lines to ensure that you don't break other contexts or count duplicates for a single context.
I'll hold my solution for now, but happy to share it after folks have a chance to attempt on their own.
- nneonneo 5y agoAs far as I could tell, 14 is the maximum, since that's the number of times your code gets injected. I didn't quite figure out why they called it the 21 vector challenge, other than a reference to the current year? If you're allowed to execute code more than once per injection site, I think the scoring would rapidly become ill-defined...
- cjcampbell 5y agoIt depends a bit on how they count contexts and injections. I did take it a little bit further after my post. I aimed to avoid double-dipping on contexts, but there's at least one element that could probably be counted for more than one injection context (and requires different strategies to target these different contexts). If nothing else, there are a couple of opportunities beyond the initial fourteen to further sharpen your XSS skills if that's of interest.