# DOM based cookie bomb

Twitter's hash-to-cookie script set unbounded cookies named from location.hash with unescaped referrer value, letting an attacker plant persistent cookies that cause HTTP 431 and block all Twitter access.

- Payout: hidden
- Severity: medium
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2017-04-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/57356
- Library page: https://bugbountylibrary.com/r/h1%3A57356
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium technique:js-analysis technique:source-review vuln:dos

**Target:** twitter.com front-end script setting cookies from location.hash and document.referrer
**Root cause:** A script on twitter.com wrote a cookie named `ev_redir_<hash>` with value `document.referrer` and no length limit; the referrer was not escaped for `;`, so an attacker could inject extra cookie attributes and oversized values.
**Steps:**
1. Attacker page loads a DoS link that navigates victim to twitter.com with a crafted long `#hash` and a referrer containing `;`-separated cookie attributes.
2. Twitter script runs `d(window.location.hash.substr(1).toLowerCase())`, building `ev_redir_<hash>=<referrer>; path=/` and assigning to `document.cookie`.
3. Unescaped `;` in referrer injects additional cookie attributes (e.g. expiry/domain) making the oversized cookie persistent across *.twitter.com.
4. Subsequent requests to Twitter carry the huge cookie header, server returns HTTP 431 and Twitter becomes inaccessible.
**How found:** Reading the first inline script block on twitter.com revealed it derived a cookie name from location.hash and value from document.referrer with no length cap or escaping, suggesting a cookie-bomb DoS.
**Exploitation:** Victim visits attacker-controlled page (http://innerht.ml/pocs/twitter-dom-based-cookie-bomb/) and clicks the DoS link; the crafted hash plus manipulated referrer cause Twitter's own script to write an oversized persistent cookie for *.twitter.com, so all later requests fail with HTTP 431, denying access to Twitter services.
**Insight:** Look for client-side scripts that reflect location.hash or document.referrer into document.cookie; unescaped `;` in referrer lets you inject cookie attributes (expiry/domain) to make an oversized cookie persistent and trigger 431 across subdomains.