Xss of localStorage on twitter

Author: nerd does not speak

 

Brief description:

It's very funny, but I can give you an xss after using your computer.

Detailed description:

Know the id of the target user. Execute js www.2cto.com in the current domain.

LocalStorage. setItem (": USER:", '{"54 lvwei": {"value": {"store": {"recentFollowers": {"value ": "hellolvwei <script> alert (/aaaaaa/) </script> "}}}}}');

Yes, it works better with xss reflection.

Proof of vulnerability:

Solution:

 

Filter and verify the data in localStorage before placing it in html.