XSS Tier 5 challenge description unclear/misleading

I am playing shop’s challs recently. This is a chall I am more confused about. I haven’t seen a question like this. According to the chall’s description Perform a *persisted* XSS attack with <iframe src="javascript:alert('xss')"> through an HTTP header., I think it is more likely perfrom a reflected xss through an HTTP header.

<bountysource-plugin>

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource. </bountysource-plugin>

[ZeddYu]

Yes. When I am playing juice-shop, I find all the description in the pwning-juiceshop book that is not displayed in the juice-shop. For example, the chall Log in with Amy’s original user credentials displayed in the pwning-juiceshop is attached with a picture. But I don’t find the picture in the juice-shop. So I have to read the hints of this chall.

Maybe the picture is well-known. Just I don’t know the picture. : )

[J12934]

I was thinking of adding something like a „Privacy and Security“ screen with a sidenav (like github settings) for the related setting like:

• change password
• 2FA
• request data export
• Access log