# performance.now + Force heavy task
{{#include ../../banners/hacktricks-training.md}}
**Exploit taken from [https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/](https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/)**
In this challenge the user could sent thousands of chars and if the flag was contained, the chars would be sent back to the bot. So putting a big amount of chars the attacker could measure if the flag was containing in the sent string or not.
> [!WARNING]
> Initially, I didn’t set object width and height, but later on, I found that it’s important because the default size is too small to make a difference in the load time.
```html
```
{{#include ../../banners/hacktricks-training.md}}