# open redirect sends authenticity_token to any website or (ip address)

Double-slash path on mobile.twitter.com treated a numeric host as a redirect target, leaking the authenticity_token to an attacker-controlled IP when a message was sent.

- Payout: $560
- Severity: medium
- Program: X / xAI
- Credited: seifelsallamy
- Disclosed: 2015-03-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/50752
- Library page: https://bugbountylibrary.com/r/h1%3A50752
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:param-pollution vuln:csrf vuln:open-redirect

**Target:** mobile.twitter.com messages endpoint (open redirect)
**Root cause:** Path beginning with `//<host>` was interpreted as a protocol-relative URL, so the app redirected to that host; the host filter blocked dots but not integer-encoded IPs.
**Steps:**
1. Visit `https://mobile.twitter.com//1572395042/messages` (integer form of 93.184.216.34).
2. Write a message and click send.
3. Observe redirect to the attacker IP with `authenticity_token` in the request.
**How found:** Noticed double-slash in path caused redirect; dot filter blocked domains, so converted example.com to IP then to a dotless integer to bypass the filter.
**Exploitation:** Attacker crafts a `//<integer-ip>/messages` link; victim composes/sends a message and the authenticity_token is delivered to the attacker's server, enabling CSRF token theft.
**Insight:** When a redirect filter blocks dots, try integer/octal/hex IP encodings (e.g. `1572395042` = 93.184.216.34) and protocol-relative `//host` paths to bypass host validation.