Loading HuntDB...

User input validation can lead to DOS

Medium
X
X (Formerly Twitter)
Submitted None
Reported by meepmerp

Vulnerability Details

Technical details and impact analysis

Uncontrolled Resource Consumption
Hi Security Team, **Summary:** There is no limit to the number of characters on phone numbers and using this you can perform a DOS Attack **Description:** On the input form of phone number in ***https://twitter.com/account/complete*** there's no Input validation using this you can send more payload and may cause of Denial of service or **503 Service Temporarily Unavailable** ## Steps To Reproduce: So this is the normal page █████████ Input this payload on the Phone number textbox ████ then submit as you can see the payload was encoded on backend so the payload may load more ████ After submitting this is the response on burp **503 Service Temporarily Unavailable** █████████ And on the page this is the result . ████████ ## Supporting Material/References: + payload.txt Thank you! Regards ## Impact Attacker can perform a DOS because of lack of input validation

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$560.00

Submitted

Weakness

Uncontrolled Resource Consumption