Youtube Vulnerability

Go down

Youtube Vulnerability Empty Youtube Vulnerability

Post by scryptz0 on Sun Aug 22, 2010 10:02 pm

In the past hour it appears YouTube has become the target of a manyakz attack, specifically targeting videos of pop singer Justin Bieber.

Videos relating to the star have been hit with a redirect hack with a number of different payloads. We’ve seen one redirect to an infamous, explicit “One Man One Jar” video while another covers the screen in the words “OMG Faggot”. A Twitter search confirms that the problem is widespread. Some users are reporting seeing a banner claiming that Bieber is dead.

Youtube Vulnerability 1278252382616-e1278253296870

So, what’s causing this? Coder Richard Cunningham writes on his Posterous blog that it relates to video comments.

It looks like they are deliberately using malformed HTML to get past YouTube’s checks for HTML sanitisation in the comments. The comment I’ve seen is using the long forgotten marquee tag and a javascript alert, though in principle it could be expanded to support XSS type flaws.

Comments on many videos, some not related to Bieber, have code like this on them:

Youtube Vulnerability Screen-shot-2010-07-04-at-14.58.45

YouTube appears to be deleting or blocking comments on many video pages. The attack comes on the same day as an apparent iTunes App Store hack came to light. We’ll update with more information as we get it.


Apart from this, InSecurityRomania shared some youtube html code injection in there site:

Very Happy

order by
union select all
from information_schema.tables
from information_schema.columns
where table_schema=database()

Youtube Vulnerability 2itj76s

Posts : 60
Join date : 2010-08-08

Back to top Go down

Back to top

Permissions in this forum:
You cannot reply to topics in this forum