301party.com: Intentionally open redirect

https://301party.com/

92•nahikoa•6mo ago

Comments

denysvitali•6mo ago

Created by wtfismyip.com - had a good laugh

mmsc•6mo ago

Is there a bug bounty? I found an open redirect.

mmastrac•6mo ago

I think you can report them here: http://localhost.301party.com

cheesekunator•6mo ago

"You cannot add 127.0.0.1 or localhost as a callback URL"

...watch me.

russelg•6mo ago

I was wondering about use cases for this, this makes so much sense now.

zzo38computer•6mo ago

Fortunately, redirection to a file: URL will result in a browser error. Unfortunately, the browser does not explain what is wrong (although the redirect can be viewed in the developer tools, you might not know to look there, and it still doesn't have an error message to explain the problem).

jasonjayr•6mo ago

While that is true for modern browsers, some backend http client libraries will follow the redirects. So; if you have a system that given an URL that fetches + displays the content, and you use a service that issues redirects to things like the AWS metadata service, or file:///etc/passwd --- well, the backend library is gonna redirect to the bad place, if it only checks the initially submitted url.

yjftsjthsd-h•6mo ago

  metadata.301party.com: 169.254.169.254
  ipv6.metadata.301party.com: [::169.254.169.254]

Why not just one name with both A and AAAA records? ...er, and why not fd00:ec2::254? (I now suspect that there's a subjoke here that I'm missing)

bombcar•6mo ago

It can be nice to have an address that is guaranteed to be one or the other.

croemer•6mo ago

Couple of s/redirct/redirect typos

65•6mo ago

Can someone explain what this is?

Jeremy1026•6mo ago

A simple utility to test 301 redirects in your project.

arjvik•6mo ago

Also of interest: https://redirect.pizza/

rlk•6mo ago

I found a couple of fun tricks you can do with this (for some definition of "fun" anyway).

Go's http.Redirect function allows non-3xx statuses, and also renders a trivial page with a status message and link:

https://301party.com/451?url=javascript:alert(%27hello%27)

Alas not infinitely recursive but enough to make your browser give up:

https://301party.com/301?url=/301?url=/301?url=/301?url=/301...

[edit to add:] https://301party.com/0 causes a panic

Pyrodogg•6mo ago

I'm so used to getting 451's that the example flew right over my head. First reaction was, "ugh this again [reaches for vpn]".

Brute Force Colors (2022)

Google Translate apparently vulnerable to prompt injection

(Bsky thread) "This turns the maintainer into an unwitting vibe coder"

Software development is undergoing a Renaissance in front of our eyes

Can you beat ensloppification? I made a quiz for Wikipedia's Signs of AI Writing

Spec-Driven Design with Kiro: Lessons from Seddle

Agents need good developer experience too

The Dark Factory

Free data transfer out to internet when moving out of AWS (2024)

Interop 2025: A Year of Convergence

Prejudice Against Leprosy

Slint: Cross Platform UI Library

AI and Education: Generative AI and the Future of Critical Thinking

Maple Mono: Smooth your coding flow

Moltbook isn't real but it can still hurt you

Take Back the Em Dash–and Your Voice

Show HN: 289x speedup over MLP using Spectral Graphs

Teaching Mathematics

3D Printed Microfluidic Multiplexing [video]

Abstractions Are in the Eye of the Beholder

Show HN: Routed Attention – 75-99% savings by routing between O(N) and O(N²)

We didn't ask for this internet – Ezra Klein show [video]

The Real AI Talent War Is for Plumbers and Electricians

Show HN: MimiClaw, OpenClaw(Clawdbot)on $5 Chips

I Maintain My Blog in the Age of Agents

The Fall of the Nerds

Show HN: I'm 15 and built a free tool for reading ancient texts.

How close is AI to taking my job?

You are the reason I am not reviewing this PR

Show HN: FamilyMemories.video – Turn static old photos into 5s AI videos