# Account Takeover in Periscope TV

Host header poisoning in Periscope's Twitter OAuth login redirects the oauth verifier to an attacker-controlled host, enabling account takeover.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: ngalog
- Disclosed: 2018-09-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/317476
- Library page: https://bugbountylibrary.com/r/h1%3A317476
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth vuln:account-takeover vuln:auth-bypass vuln:host-header

**Target:** Twitter OAuth login endpoint /i/twitter/login
**Root cause:** The OAuth redirect destination is built from the untrusted Host header, so a crafted Host value redirects the oauth token/verifier to an attacker-controlled domain.
**Steps:**
1. Visit https://www.periscope.tv/ and click login with twitter; observe `GET /i/twitter/login?csrf=...` with `Host: www.periscope.tv`.
2. Change the Host header to `Host: hackerone.com/www.periscope.tv`.
3. Response is a meta refresh to `https://twitter.com/oauth/authenticate?oauth_token=...`; the redirect destination resolves to `hackerone.com/www.periscope.tv`.
4. Send the resulting link to the victim; after they authorize, the oauth token and verifier are sent to the attacker's host.
5. Reuse the captured token/verifier to take over the victim's account.
**How found:** Noticed the login flow's redirect destination was derived from the Host header and tested replacing it with an attacker-controlled host to redirect the OAuth token.
**Exploitation:** Attacker crafts a login link with a poisoned Host header so the OAuth callback/verifier is delivered to attacker.com; victim authorizes via Twitter and the token+verifier land on the attacker's server, who replays them to hijack the account.
**Insight:** On OAuth login endpoints, test whether the post-auth redirect/callback host is built from the Host header rather than a fixed allowlisted value; a path-style Host like `attacker.com/target.com` can pass naive checks.