Clever #BugBountyTip from @bugraeskici: if you stumble upon a URL whitelist, try special characters (like ğ). Some parsers can't render them and change it to "?", allowing URL whitelist bypass!
Shoutout to @samwcyo, who tweeted out something similar before:
https://twitter.com/samwcyo/status/1246997498981494784?s=21 https://twitter.com/samwcyo/status/1246997498981494784
You can follow @intigriti.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled: