6 ms·
As far as I could tell, 14 is the maximum, since that's the number of times your code gets injected. I didn't quite figure out why they called it the 21 vector
by nneonneo 5y ago
As far as I could tell, 14 is the maximum, since that's the number of times your code gets injected. I didn't quite figure out why they called it the 21 vector challenge, other than a reference to the current year?
If you're allowed to execute code more than once per injection site, I think the scoring would rapidly become ill-defined...
- cjcampbell 5y agoIt depends a bit on how they count contexts and injections. I did take it a little bit further after my post. I aimed to avoid double-dipping on contexts, but there's at least one element that could probably be counted for more than one injection context (and requires different strategies to target these different contexts). If nothing else, there are a couple of opportunities beyond the initial fourteen to further sharpen your XSS skills if that's of interest.