Thank’s for information. Encoded with base64 XSS code also belongs to this type of XSS which I called Encrypted XSS. All encrypted (with any ecryption) XSS holes belong to it. In this case, as you see, it’s not base64, but eBay’s own encryption algorithm.

Yes, this type of XSS can be used to bypass server-side and client-side firewalls, which block XSS attacks, like NoScript.

Hole at Yahoo! is nice. It’s not first base64 encrypted XSS - there was such one at MySpace, which was disclosed in 2007 in project Month of MySpace Bugs. But only after I found this XSS at eBay in 26.11.2007, I created this new type of XSS (as a part of my Classification of Cross-Site Scripting). And so I called this hole first Encrypted XSS (and it’s first with such encryption).

Yahoo! (at least) once got this kind of encoded XSS.

http://bbs.cn.yahoo.com/searchApplyBoard/PHNjcmlwdD5hbGVydCgiWFNTLWJ5cGFzcy1Oby1TY3JpcHQiKTwvc2NyaXB0Pg==.html

The XSS is encoded with base64(). This XSS was once bypassed No-Script protection too

You can see Maone’s comment here :

http://zoiz.web.id/xss-corner/base64-encoded-xss.html