301party.com: Intentionally open redirect

https://301party.com/

92•nahikoa•6mo ago

Comments

denysvitali•6mo ago

Created by wtfismyip.com - had a good laugh

mmsc•6mo ago

Is there a bug bounty? I found an open redirect.

mmastrac•6mo ago

I think you can report them here: http://localhost.301party.com

cheesekunator•6mo ago

"You cannot add 127.0.0.1 or localhost as a callback URL"

...watch me.

russelg•6mo ago

I was wondering about use cases for this, this makes so much sense now.

zzo38computer•6mo ago

Fortunately, redirection to a file: URL will result in a browser error. Unfortunately, the browser does not explain what is wrong (although the redirect can be viewed in the developer tools, you might not know to look there, and it still doesn't have an error message to explain the problem).

jasonjayr•6mo ago

While that is true for modern browsers, some backend http client libraries will follow the redirects. So; if you have a system that given an URL that fetches + displays the content, and you use a service that issues redirects to things like the AWS metadata service, or file:///etc/passwd --- well, the backend library is gonna redirect to the bad place, if it only checks the initially submitted url.

yjftsjthsd-h•6mo ago

  metadata.301party.com: 169.254.169.254
  ipv6.metadata.301party.com: [::169.254.169.254]

Why not just one name with both A and AAAA records? ...er, and why not fd00:ec2::254? (I now suspect that there's a subjoke here that I'm missing)

bombcar•6mo ago

It can be nice to have an address that is guaranteed to be one or the other.

croemer•6mo ago

Couple of s/redirct/redirect typos

65•6mo ago

Can someone explain what this is?

Jeremy1026•6mo ago

A simple utility to test 301 redirects in your project.

arjvik•6mo ago

Also of interest: https://redirect.pizza/

rlk•6mo ago

I found a couple of fun tricks you can do with this (for some definition of "fun" anyway).

Go's http.Redirect function allows non-3xx statuses, and also renders a trivial page with a status message and link:

https://301party.com/451?url=javascript:alert(%27hello%27)

Alas not infinitely recursive but enough to make your browser give up:

https://301party.com/301?url=/301?url=/301?url=/301?url=/301...

[edit to add:] https://301party.com/0 causes a panic

Pyrodogg•6mo ago

I'm so used to getting 451's that the example flew right over my head. First reaction was, "ugh this again [reaches for vpn]".

Show HN: I built a clawdbot that texts like your crush

Scientists reverse Alzheimer's in mice and restore memory (2025)

Compiling Prolog to Forth [pdf]

Show HN: Cymatica – an experimental, meditative audiovisual app

GitBlack: Tracing America's Foundation

Horizon-LM: A RAM-Centric Architecture for LLM Training

We just ordered shawarma and fries from Cursor [video]

Correctio

Trying to make an Automated Ecologist: A first pass through the Biotime dataset

Watch Ukraine's Minigun-Firing, Drone-Hunting Turboprop in Action

Free Trial: AI Interviewer

FDA Intends to Take Action Against Non-FDA-Approved GLP-1 Drugs

Supernote e-ink devices for writing like paper

We are QA Engineers now

Show HN: Measuring how AI agent teams improve issue resolution on SWE-Verified

Adversarial Reasoning: Multiagent World Models for Closing the Simulation Gap

Show HN: Poddley.com – Follow people, not podcasts

Layoffs Surge 118% in January – The Highest Since 2009

Papyrus 114: Homer's Iliad

DicePit – Real-time multiplayer Knucklebones in the browser

Turn-Based Structural Triggers: Prompt-Free Backdoors in Multi-Turn LLMs

Show HN: AI Agent Tool That Keeps You in the Loop

Why Every R Package Wrapping External Tools Needs a Sitrep() Function

Achieving Ultra-Fast AI Chat Widgets

Show HN: Runtime Fence – Kill switch for AI agents

Researchers surprised by the brain benefits of cannabis usage in adults over 40

Peter Thiel warns the Antichrist, apocalypse linked to the 'end of modernity'

USS Preble Used Helios Laser to Zap Four Drones in Expanding Testing

Show HN: Animated beach scene, made with CSS

An update on unredacting select Epstein files – DBC12.pdf liberated