Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Chaofan Shou Profile picture
@shoucccc
Dec 13, 2023 • 7 tweets • 4 min read • Read on X
Scrolly
😝 Here is the full disclosure of the Twitter XSS + CSRF vulnerability.

Clicking a crafted link or going to some crafted web pages would allow attackers to take over your account (posting, liking, updating your profile, deleting your account, etc.)
On 12/11, @rabbit_2333 posted details about an XSS on the Twitter subdomain .

analytics.twitter.com
This XSS seems to be nothing beyond alert popper because:

1). Twitter's cookies are HttpOnly, meaning reading them using Javascript is impossible.

2). There are CSRF tokens, so no CSRF attacks.

3). Strict same site policy on , so no CSRF attacks to it. twitter.com
Image
However, I figured out some undocumented endpoints on also support using cookies to access. This means that any XSS on subdomains of Twitter can send requests to and impersonate the user. This solves problems 1 and 3. api.twitter.com
api.twitter.com

Image
Image
Reverse engineering the JS code of , I found that the CSRF token is just a hash of csrf_id in the cookie. Surprisingly, the csrf_id is not HttpOnly cookie, meaning that subdomain XSS can read this csrf_id and create CSRF tokens. This solves problem 2. twitter.com
Image
And we got the full JS exploit to chain with this XSS vulnerability!

In another word, visiting this link earlier today would take over your account: analytics.twitter.com/mob_idsync_cli…
Image
It is highly irresponsible for Twitter to ignore these security issues and not pay the whitehats. The architecture and design patterns also need to be corrected.

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Chaofan Shou

Chaofan Shou Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @shoucccc

Chaofan Shou Profile picture
Aug 24, 2024
Confession: I and @tonyke_bot printed ~$20K in 4hrs by sandwiching @four_meme_ trade. Here are the technical details, code, and giveaways 🧵🧵 Image
We saw a few high-profit sandwiches on Thursday at midnight. This is uncommon because the profit for most sandwiches today is less than $1.

Join our group to watch interesting MEV bots together: t.me/+GU0tYsLwVPs4M…
Image
It is apparent that this bot is sandwiching @four_meme_ trades. @four_meme_ somehow became really popular on Thursday. A lot of people created and bought tokens. Image
Read 14 tweets
Chaofan Shou Profile picture
Jul 25, 2024
We stopped a $2.8M hack targeting AllianceBlock.

Details👇🧵 Image
Vulnerabilities: AllianceBlock upgraded one of its staking contracts to accept new tokens due to the Bonq DAO hack two years ago. Two storage variables were deleted in the new implementation, making the storage slot `initialized` (originally at 0x12, with value 1) aliased with a slot (0xf) holding an address. The value of `initialized` is important because it indicates whether the contract has been initialized. The contract is supposed to be only initialized once.

As an address is 160 bits, the leading 96 bits in the slot are all 0s. After aliasing, `initialized` is now at slot 0xf's 95th bit, which is 0, making the contract uninitialized.

Under the current state, an attacker can re-initialize the contract. In AllianceBlock's staking contract, re-initializing can reset the `rewardRate`, `rewardToken`, and `stakingToken`. To drain `rewardToken` in the contract, one can simply inflate the `rewardRate` such that by staking a very small amount of tokens, they can get an infinite amount of reward tokens back.

It becomes a bit tricky to steal `stakingToken`. One possible way would be resetting the `stakingToken` to a contract the attacker can control, and conduct a fake stake. As soon as the developer upgrades the contract again, the attacker can backrun the upgrade transaction to unstake real staking tokens, draining them without paying anything. There might be additional ways to exploit, as we did not dig too deep.

Upgrade Tx:
Decompiled New Implementation: etherscan.io/tx/0x48dcb38af…
app.dedaub.com/decompile?md5=…Image
What happened: Our bot saw a tornado-cash-funded account interact with the staking contract, staking a tiny amount of tokens. To determine its intention, our bot submitted the contract for analysis to identify all possibilities to backrun that transaction so that we could drain funds from it. In less than 1ms, our bot derived the exploit that could drain all reward tokens in the contract.

The contract was then submitted for further analysis with fuzzer and symbolic execution tools. In ~4s, our engineers got a notification about all vulnerabilities and exploits to drain all tokens in the contract.

We notified the team, and luckily, they managed to fix the contract immediately.Image
Read 4 tweets
Chaofan Shou Profile picture
Apr 14, 2024
Technical details on how we made $10k/hr by mining $ORE via @bloXrouteLabs @jito_sol and GPUs.

[1/8] 🧵Image
@bloXrouteLabs @jito_sol [2/8] WTF is $ORE

ORE is a token on Solana with a mining program. One can claim ORE from the mining program by sending correct nonces (calculated by trying hashes) to it.

A mining tx looks like this: Image
@bloXrouteLabs @jito_sol [3/8] Initial Attempt for Landing Tx

Due to the massive amount of miners clogging the Solana network, it is extremely tough to land any tx.

We initially tried a strategy MEV bots used: blindly sending millions of txs every second to every open RPC on the Internet. Image
Read 9 tweets
Chaofan Shou Profile picture
May 9, 2023
How to make $800k every day by rug pulling?

A tutorial 🧵[1/7] Image
Create an ERC20 token, preferably with some funky names.

Some examples 👇

[2/7] Image
Make your scam token tradeable by creating a liquidity pool (LP). You can use Uniswap / PancakeSwap for this.

You initially need to add ~$50k value of assets to LP to get victims' attention.

[3/7] Image
Read 8 tweets
Chaofan Shou Profile picture
May 8, 2023
gg! Our fuzzer can solve all challenges automatically in <16hrs on single core with some fine tunings 🔥🔥

Will share the writeup

Try it out: github.com/fuzzland/ityfu…
And kudos to @publicqi for solving even faster than the fuzzer and using less gas
and big thank you to @merklejerk @dragonfly_xyz for organizing such a fun CTF!
Read 4 tweets
Chaofan Shou Profile picture
Apr 20, 2023
🈹 Stop buying #pepedao / #pipipump / #bobcoin, owner can rug you.

Scammer deployed >67 malicious tokens. These contracts are obfuscated and designed to bypass @GoplusSecurity & @Token_Sniffer's rugpull analysis.

~$300k funds have already been rugged.

#ScamAlert #rugpull twitter.com/i/web/status/1… Image
@GoplusSecurity @Token_Sniffer So, what's going on?

1. The attacker uses "oowner" to define the owner so that analysis considers the contract has no owner -- really benign in the eye of static analysis! twitter.com/i/web/status/1…
@GoplusSecurity @Token_Sniffer 2. The code for rug pull is inside "transfer" and "Approve" functions, very unconventional.
Read 8 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(