How has MechaTech84 got 160 points?

[GraemeARobinson]

Unless my maths is off then there's only 150 points up for grabs.

(10*1)+(18*5)+(5*10) = 10+90+50 = 150

Are there some "secret" labs?

[paj28]

Good spot. Yeah, there were a couple of labs with bugs that I unpublished. And unpublish doesn't remove the points scored. Perhaps it should...

Split Payload XSS was too easy to exploit with just one input, I need to figure out something that can only be exploited using two fields.

HTML Filter - SVG Bypass I haven't got a solution for just now, although I think it's possible. It was previously solvable in an unintentional way due to a bug in the lab that ended up being the idea behind "HTML Filter - Attribute Bypass".

[Scrubz-Tech]

I don't think you should.

After all, we're hackers, bypassing restrictions and bugs is what we do. :D

[MechaTech84]

I've been setting up a couple labs that are currently considered impossible, they're currently only visible under the "Impossible" tag:

https://xssy.uk/allLabsByTag

[MechaTech84]

I would prefer to lose the points rather than have a score that is literally unattainable.

[GraemeARobinson]

That's very noble of you

[MechaTech84]

As much as it sucks losing points, I think it's even worse not being able to get them in the first place. I definitely want to be unbeatable, but not because of an unfair playing field, lol.

[paj28]

Ok, I've done a one-off job to fix up the scores. At some point I'll do a proper fix.