# Protected tweets exposure through the URL

Twitter search redirects to a URL with f=tweets only when results exist, letting an attacker binary-search protected tweets via cross-origin URL state leaks.

- Payout: $560
- Severity: high
- Program: X / xAI
- Credited: terjanq
- Disclosed: 2019-04-19
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/491473
- Library page: https://bugbountylibrary.com/r/h1%3A491473
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high technique:blind technique:chained technique:recon vuln:info-disclosure

**Target:** twitter.com/search endpoint
**Root cause:** Search results page conditionally adds the f=tweets parameter to the URL only when matches are found, creating an observable cross-origin state difference that leaks whether a protected tweet matches a query.
**Steps:**
1. Create victim account with 'Protect your Tweets' enabled and post phrases containing digits.
2. Attacker page opens twitter.com/search?q=<query>%20from%3A<victim> in a window.
3. Detect whether URL gained f=tweets parameter (via the URL-leak technique from report 491243).
4. Use OR-combined candidate values (e.g. `1001 OR 1002 OR ...`) up to 50 words per query to binary-search digits.
5. Iterate ~300 requests to enumerate all 3-4 digit numbers, then reconstruct phrases like card numbers.
**How found:** Researcher noticed that searching with no results redirected to a URL containing f=tweets while searches with results did not, revealing a state leak tied to result existence.
**Exploitation:** Attacker hosts a page that repeatedly opens search URLs for the victim's protected tweets and observes the resulting URL state to determine match/no-match, using OR operators and binary search to extract numeric sequences from private tweets.
**Escalation:** Chained with logical OR operators and binary search to reduce request count; parallel windows speed extraction; can reconstruct full phrases such as credit card numbers.
**Insight:** Conditional URL rewrites (adding/removing query params based on result state) are cross-origin observable oracles; test search/filter endpoints for state-dependent redirects to leak private data via binary search.