HexBrain

X / xAI · Report #33331

Flaw in valid password policy.

Informativestatus
3upvotes
30 Nov 2014disclosed

How it was found

Steps to reproduce

  1. Go to twitter.com
  2. Login with your existing password
  3. Change your password from settings.Make 6 space character as your password.
  4. After successful update of your password,logout from twitter.com
  5. Now login from mobile.twitter.com with existing password (which is 6 or more or less space characters)
  6. Now go to settings.
  7. Try to update your password.
  8. Every time you you request for update,it will say password can't be blank.So you will never be able to update your password from mobile.twitter.com again.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original