lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 22 Jan 2013 01:02:38 +0100
From: Jakub Zoczek <>
Cc: Hispabyte HQH <>,,,,,,,
Subject: Re: [0 Day] XSS Persistent in Blogspot of Google


*Execution of owner-supplied JavaScript on Blogger:* Blogger users are
permitted to place custom JavaScript in their own blog templates and blog
posts; our take on this is that blogs are user-generated content, not
different from any third-party website on the Internet. Naturally, for your
safety, we do employ spam and malware detection technologies - but we
believe that the flexibility in managing your own content is essential to
the success of our blogging platform.

*Therefore, the ability to execute owner-supplied scripts on your own blog
is not considered to be a vulnerability. That being said, the ability to
inject arbitrary JavaScript onto somebody else’s blog would likely qualify
for a reward!

*Source <>*


On Tue, Jan 22, 2013 at 12:01 AM, ANTRAX <> wrote:

> Hi all, I'm ANTRAX from Argentina, and I'm owner of
> Today, I going to shared with you about XSS in blogger. This is a very
> simple, but isn´t fix yet..
> This bug could be exploited by bloggers without administrator permissons.
> Steps to reproduce the XSS:
> 1.- Create a new post in the blog and insert some script
> [image: Imágenes integradas 1]
> 2.- When the administrator enter in the administration panel in
> "templates" section, blogger automatically executed the script, because
> blogger have a mini-preview in "Ahora en el blog", then execute the script
> [image: Imágenes integradas 2]
> 3.- Ready! the script has been executed!
> [image: Imágenes integradas 3]
> Also, you can steal cookies!
> [image: Imágenes integradas 4]
> I reported to google about it, but they not fixed yet.
> Kind regards partners!

Content of type "text/html" skipped

Download attachment "xss4.png" of type "image/png" (31412 bytes)

Download attachment "xss2.png" of type "image/png" (121499 bytes)

Download attachment "xss1.png" of type "image/png" (30859 bytes)

Download attachment "Blogger XSS.png" of type "image/png" (240406 bytes)

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists