+ Reply to Thread
Results 1 to 3 of 3
  1. 07-04-2010 #1
    WhoIsYou's Avatar
    WhoIsYou
    Currently Offline Administrator WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs
    Join Date
    May 2008
    Location
    In the interwebz
    Posts
    5,057
    Points
    1,670,942.99
    Rep Power
    233

    Default Heh... Youtube got owned...

    4chan had a field day, an XSS flaw was found, allowing anyone to inject unsanitized html/javascript into youtube comments.

    Here's a thread on the google support site that someone made about it:
    http://www.google.com/support/forum/...2a699910&hl=en

    Here's a comment from another site giving some details on how it was done and such.
    Quote Originally Posted by audiodude
    It has nothing to do with

    IF_HTML_FUNCTION

    Tested on my own video here: http://www.youtube.com/watch?v=ujr1JSYe4UU

    All you need is:

    <script><script>PAYLOAD

    Any HTML after the second non-closed script tag survives unescaped. /b/ is having a field day, because it's easy copypasta page breaking.

    YouTube escapes the first script tag and not the second.

    Edit: okay here it is:

    <script><unescaped_html_here><do_what_ever_you_wan t><body onload="alert('is quite popular');"> <h1>Big header? Nope!</h1>

    results in this being put in the page.

    &lt;script&gt;<unescaped_html_here><do_what_ever_y ou_want><body onload="alert('is quite popular');"> &gt;h1&lt;Big header? Nope!&gt;/h1&lt;

    Remember to close the div of the comment box if you want the page to stay semi-functional.

    Anyway, yeah, this technically means that your account could have beeen 'hacked' (session hijacked) if you watched any vids or viewed anyone's page today while logged in (anywhere with comments).

    Kinda sad that this flaw even existed tbh D:
    Here's an article about it: http://thenextweb.com/socialmedia/20.../#comment-9023
    Seems they targeted justin bieber vids and shit, fucking lulz.
    Reply With Quote Reply With Quote  
  2. 07-04-2010 #2
    Blaze_Fire's Avatar
    Blaze_Fire
    Currently Offline Elite Contributor Blaze_Fire is a well respected member Blaze_Fire is a well respected member
    Join Date
    Jun 2008
    Location
    Yes.
    Posts
    477
    Points
    499,182.80
    Rep Power
    210

    Default Re: Heh... Youtube got owned...

    Guy on the google support link said it was ebaumsworld.. either way, still funny.
    Reply With Quote Reply With Quote  
  3. 07-04-2010 #3
    WhoIsYou's Avatar
    WhoIsYou
    Currently Offline Administrator WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs WhoIsYou has elite repututaion around codinghs
    Join Date
    May 2008
    Location
    In the interwebz
    Posts
    5,057
    Points
    1,670,942.99
    Rep Power
    233

    Default Re: Heh... Youtube got owned...

    Quote Originally Posted by Blaze_Fire View Post
    Guy on the google support link said it was ebaumsworld.. either way, still funny.
    -_- Everything is ALWAYS blamed on ebaums...
    Reply With Quote Reply With Quote  
+ Reply to Thread
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Forum Rules