X (Formerly Twitter): Add tweet to collection CSRF

Hi Team, I have found a CSRF vulnerability which force victim to add tweets in his collection. HTML POC : Before using this POC change the Collection ID to your collection ID and you will see that tweet will be added into your collection.You can Also add so many tweets in one request by adding...

Anonymous Hacking Group Takes Down 20,000 ISIS Twitter accounts

In the wake of horrific terror attacks in Paris, the online Hacktivist group Anonymous last week declared "total war" against the Islamic State militant group ISIS that claimed responsibility for the attacks. While French, Russian, and US military are bombing ISIS from the sky, Anonymous members...

ISIS Calls Anonymous "IDIOTS" and Issues 5 Lame Tips for its Members to Avoid Getting Hacked

The Anonymous Hacking group on Sunday declared Total War against the ISIS, the Islamic State terror organization that claimed responsibility for the Paris attacks on Friday that killed 129 people and hundreds more injured. In a sinister video posted on YouTube, the Cyber Hacktivists said they wil...

X (Formerly Twitter): Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference)

Hi Team, You can tweet from your ad account while creating a campaign.When you add a media content from your computer and upload it there is a Json request which gives you the link of your mediaPhotos to preview before Tweeting.This link is Vulnerable to IDOR Attack and it leads to disclose all t...

ISIS Supporter Hacks 54,000 Twitter Accounts and Posts Details of Heads of the CIA and FBI

ISIS hackers have hacked tens of thousands of Twitter accounts, including the accounts of the members of CIA and the FBI, in revenge for the US drone strike that killed a British ISIS extremist in August. The Cyber Caliphate, a hackers group set up by British ISIS member Junaid Hussain, urged its...

X (Formerly Twitter): Following a User After Favoriting Actually Follows Another User (related to #95243)

Hi, There appears to be a bug similar to 95243 which affects following a user after favoriting one of their tweets via an Intent dialog. The following is a proof of concept: https://twitter.com/intent/favorite/?tweetid=661625230297821184&screenname=ericrtest3 The screenname param submits with the...

Gold MP4 Player - '.swf' Local Overflow

!/usr/bin/python EXPLOIT TITLE: GOLD PLAYER Local Exploit AUTHOR: Vivek Mahajan - C3p70r Credits: Gabor Seljan Date of Testing: 30 October 2015 Download Link : http://download.cnet.com/GoldMP4Player/3000-21394-10967424.html Tested On : Windows 8.1 Pro and Windows 7 Ultimate Steps to Exploit Step ...

X (Formerly Twitter): Can see private tweets via keyword searches on tweetdeck

I'm not the best at finding "why" this happened, but I am pretty sure it's not supposed to. I was keyword searching "protonmail invite" and this came up even though the user was not on public nor did i follow him. I go to twitter.com and search for the exact same tweet, nothing comes up of his...

Keybase: Un-handled exception leads to Information Disclosure

Steps: 1. Login to https://keybase.io/ 2. Click on Me icon from top-right button https://keybase.io/username 3. Click on Edit picture button https://keybase.io/usernameedit-me 4. Intercept the traffic using proxy tool e,g, Burp Suite 5. Click on "Prove my Twitter identity" link 6. In the request,...

Yahoo Hires Bob Lord as CISO

Yahoo has filled the vacancy in its CISO office, today announcing the hiring of former Twitter and Rapid7 security executive Bob Lord. Lord starts in his new role Nov. 9. He was most recently Rapid7’s CISO-in-residence; he has spent much of the last two decades in high-profile security positions...

X (Formerly Twitter): CSRF on cards API

Hi, I would like to report an CSRF issue on the cards API endpoint /i/cards/api/v1.json. Detail Currently the endpoint is responsible for poll cards maybe more to come. When a user votes, a request will be sent to this endpoint to record the user's selected choice. By default there's a CSRF...

X (Formerly Twitter): Following a User Actually Follows Another User

I can display a web intent page to a victim that appears to prompt them to follow one user, but actually ends up following a completely different user when they click "follow". The following is a proof of concept:...

X (Formerly Twitter): XSS in the "Poll" Feature on Twitter.com

I have found an XSS on the "Poll" feature on Twitter.com. Payload Example: Screenshot: I have attached a screenshot in this submission in order to demonstrate the issue. Best, Mazin...

High school Student Hacked Into CIA Director's Personal Email Account

A self-described teenage hacker has claimed to have hacked into personal AOL email account of Central Intelligence Agency CIA Director John Brennan and swiped sensitive top-secret data. It's Really a major embarrassment for Brennan as well as the CIA. The hacker, who describes himself as an...

JScript 5.7 RegExpBase::FBadHeader Use-After-Free

Recompiling the regular expression pattern during a replace can cause the code to reuse a freed string, but only if the string is freed from the cache by allocating and freeing a number of strings of certain size. CVE-2015-2482: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2482...

WordPress JM Twitter Cards Plugin <= 6.1 - Full Path Disclosure

Because of this vulnerability, attackers can discover the full path to the WordPress installation on the server, which they could use to assist in other attacks. Solution Update this plugin...

Breaking: Edward Snowden Joins Twitter & Only Follows ‘NSA’

Whistleblower Edward Snowden just joined Twitter, and his first tweet seems to be directed at the US National Security Agency NSA. Yes, the world's most popular whistleblower and data privacy advocate has finally joined Twitter just two hours ago, and his first tweet came, “Can you hear me now?”...

X (Formerly Twitter): Tweetdeck (twitter owned app) not revoked

I've noticed an issue in tweetdeck & twitter. If you try to revoke tweet deck, no matter what you do, if anyone else is logged in on your account through tweetdeck, they will still be able to use your account. This doesn't properly revoke users, so therefore I thought this as is a bug/problem e.g...

Drupal Twitter Module Security Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP. The Drupal Twitter module failed to properly check access permissions, allowing a remote attacker to post tweets to arbitrary accounts with the 'post to twitter' permission...

CVE-2015-7229

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...