User input validation can lead to DOS
Medium
X
X (Formerly Twitter)
Submitted None
Actions:
Reported by
meepmerp
Vulnerability Details
Technical details and impact analysis
Hi Security Team,
**Summary:**
There is no limit to the number of characters on phone numbers and using this you can perform a DOS Attack
**Description:**
On the input form of phone number in ***https://twitter.com/account/complete*** there's no Input validation using this you can send more payload and may cause of Denial of service or **503 Service Temporarily Unavailable**
## Steps To Reproduce:
So this is the normal page
█████████
Input this payload on the Phone number textbox ████ then submit as you can see the payload was encoded on backend so the payload may load more
████
After submitting this is the response on burp **503 Service Temporarily Unavailable**
█████████
And on the page this is the result .
████████
## Supporting Material/References:
+ payload.txt
Thank you!
Regards
## Impact
Attacker can perform a DOS because of lack of input validation
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$560.00
Submitted
Weakness
Uncontrolled Resource Consumption