X / xAI · Report #46818
Twitter Card - Parent Window Redirection
Validstatus
$560bounty
3upvotes
4 May 2015disclosed
How it was found
Hi, I was trying to find XSS on another website and I finally did.
After that I tried share this url on Twitter to show website owner, and noticed that I can run javascript on that iframe.
Javascript that I used on Twitter Card :
<script>top.window.location.href="https://google.com.tr"</script>You can watch PoC