# Twitter - protected tweets exposure

Twitter search redirects to a different URL when no results exist, letting an attacker XS-Leak protected tweets via binary search on search queries.

- Payout: unconfirmed
- Severity: medium
- Program: Twitter
- Credited: terjanq
- Disclosed: 2019-04-19
- Write-up quality: 7/10
- Original: https://terjanq.github.io/Bug-Bounty/Twitter/protected-tweets-exposure-efvju8i785y1/
- Library page: https://bugbountylibrary.com/r/blog%3Aterjanq-github-io-bug-bounty-twitter-protected-tweets-exposure-efvju8i785y1
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:medium technique:blind technique:chained vuln:info-disclosure vuln:xs-leak

**Target:** twitter.com/search endpoint
**Root cause:** The search endpoint conditionally adds the f=tweets parameter and redirects only when no results are found, creating an observable state difference that leaks whether a query matched protected tweets.
**Steps:**
1. Create victim account with 'Protect your Tweets' enabled and tweets containing target phrases.
2. Attacker page loads `https://twitter.com/search?q=<query>&src=typd` in a window/frame.
3. Detect whether URL changed to include `f=tweets` (no results) vs stayed (results found) using the previously reported URL-change detection technique.
4. Use Advanced Search operators (`from:username`, AND/OR) to binary-search digits/phrases, e.g. `1001 OR 1002 OR ...` up to 50 terms per query.
5. Iterate ~300 requests to extract all 4-digit numbers, then reassemble phrases like credit card numbers.
**How found:** While hunting URL exposure bugs on Twitter, noticed the search URL redirects (adding f=tweets) only when no results are returned, and realized this conditional redirect is an observable cross-origin state.
**Exploitation:** Attacker hosts a page that repeatedly opens the Twitter search URL for crafted queries against the victim's username; by observing the redirect/no-redirect state per query, the attacker performs binary search over digits and words to reconstruct protected tweet content without authentication.
**Escalation:** Parallel windows speed up extraction; logical OR batching (up to 50 terms) reduces request count to ~300 for 4-digit numbers.
**Insight:** Conditional redirects/URL mutations on search endpoints are XS-Leak oracles: any server-side branch that changes the URL based on result existence can be turned into a membership oracle against private content.