Tom Scott

How The Self-Retweeting Tweet Worked: Cross-Site Scripting (XSS) and Twitter (2014x63)

Air date: Jun 11, 2014

It should never have happened. Defending against cross-site scripting (XSS) attacks is Web Security 101. And yet, today, there was a self-retweeting tweet that hit a heck of a lot of people - anyone using Tweetdeck, Twitter's "professional" client. How did it work? Time to break down the code. (Remember the old Myspace worms? They worked the same way.)