# Twitter iOS fails to validate server certificate and sends oauth token

Twitter iOS app failed to validate TLS certificates, letting a rogue Wi-Fi AP transparent-proxy api.twitter.com traffic and capture OAuth tokens and auth headers.

- Payout: $2,100
- Severity: high
- Program: X / xAI
- Credited: floyd
- Disclosed: 2016-12-23
- CVE: CVE-2016-10511
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/168538
- Library page: https://bugbountylibrary.com/r/h1%3A168538
- Tags: domain:mobile domain:network impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:ios technique:recon vuln:info-disclosure vuln:misconfiguration vuln:secrets-leak

**Target:** Twitter iOS app (api.twitter.com HTTPS traffic)
**Root cause:** The Twitter iOS client did not validate the server's TLS certificate chain, accepting any CA-signed (or self-signed) cert presented by a MITM proxy.
**Steps:**
1. Run Burp in transparent mode with 'Generate CA-signed per-host certificates' (Burp CA untrusted on device).
2. Start rogue Wi-Fi AP on same host.
3. Redirect port 443 to proxy: `iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 443 -j REDIRECT --to-port 8080`.
4. Connect stock iPhone (no profiles/CA installed) to the rogue AP.
5. Open Twitter app; observe api.twitter.com requests in Burp including OAuth token and auth headers.
**How found:** Researcher set up a transparent MITM proxy on a rogue AP and noticed the stock, non-jailbroken iPhone app still sent requests to api.twitter.com through the untrusted Burp CA, indicating no cert validation.
**Exploitation:** Attacker stands up a rogue Wi-Fi AP and transparent proxy; any victim on stock iOS connecting to it has their Twitter app's api.twitter.com traffic decrypted, exposing OAuth tokens and account auth data for takeover.
**Insight:** Test mobile apps on stock devices via rogue-AP transparent proxy with an untrusted CA — if traffic decrypts without installing a profile, cert pinning/validation is absent; check auth-bearing endpoints like settings.json for token leakage.