Hello,
Agree with Michal. It is very interesting to get to know know new
complex xss vulnerabilities.
IMAHO, the issue here is claiming to have found a vulnerability
without providing a PoC of how to use it to violate a security policy
of the targeted service, probably because there are none,
Agree with Michal,
at the end you achieve code execution with an XSS as well, it's just in
the DOM.
Depending on the attack surface, browser type and so on, this can be
devastating.
I bet you remember the XSS on Amazon EC2 web interface, which combined
with XSRF lead to stealing x.509
OGMMM WTFF 0DAY XSS
Sorry, getting a bit tired of these.
Well, the world is changing. You can probably do a lot more direct damage
with a (legit) XSS in a high-value site than with a local privilege
escalation in sudo.
XSS reports are less actionable for the average reader, but full
OGMMM WTFF 0DAY XSS
Sorry, getting a bit tired of these.
On 26 January 2013 02:50, ANTRAX antrax...@gmail.com wrote:
Gynvael Coldwind, I know this and I posted a reply in Underc0de about that.
http://underc0de.org/foro/hacking-showoff/xss-persistente-blogger-13978/
It isn't a critical bug
Hey ANTRAX,
JZ is correct, even in the template view the script is still executed only
in the *.blogspot.com context, and not in the context of blogger.com - look
at your first screenshot - it's clearly said there that the alert box
popped up on *.blogspot.com.
It's good to always
Gynvael Coldwind, I know this and I posted a reply in Underc0de about that.
http://underc0de.org/foro/hacking-showoff/xss-persistente-blogger-13978/
It isn't a critical bug but, despite that, this shouldn't happen..
Thanks all!
---
Best Regards
*ANTRAX*
2013/1/25 Gynvael Coldwind
