Full Disclosure: Re: Youtube xss

[rafael.gomes () ufba br]

They already fixed this! I tried.
-- 
Rafael Gomes via Webmail
Analista de Segurança
LPIC-1 MCSO
DISUP/CPD/UFBA
Tel : +55 71 3283 6100


Citando Christopher Grant <chrisgrantmail () gmail com>:

> See http://www.youtube.com/watch?v=0xFbldgYVwQ for an example. It would
> appear that including something along the lines of "*
> <script>IF_HTML_FUNCTION?*" followed by your payload in a comment bypasses
> youtube's xss defenses. Pretty big hole eh?
> - Chris


----------------------------------------------------------------
Universidade Federal da Bahia - http://www.portal.ufba.br

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/