301party.com: Intentionally open redirect

https://301party.com/

92•nahikoa•6mo ago

Comments

denysvitali•6mo ago

Created by wtfismyip.com - had a good laugh

mmsc•6mo ago

Is there a bug bounty? I found an open redirect.

mmastrac•6mo ago

I think you can report them here: http://localhost.301party.com

cheesekunator•6mo ago

"You cannot add 127.0.0.1 or localhost as a callback URL"

...watch me.

russelg•6mo ago

I was wondering about use cases for this, this makes so much sense now.

zzo38computer•6mo ago

Fortunately, redirection to a file: URL will result in a browser error. Unfortunately, the browser does not explain what is wrong (although the redirect can be viewed in the developer tools, you might not know to look there, and it still doesn't have an error message to explain the problem).

jasonjayr•6mo ago

While that is true for modern browsers, some backend http client libraries will follow the redirects. So; if you have a system that given an URL that fetches + displays the content, and you use a service that issues redirects to things like the AWS metadata service, or file:///etc/passwd --- well, the backend library is gonna redirect to the bad place, if it only checks the initially submitted url.

yjftsjthsd-h•6mo ago

  metadata.301party.com: 169.254.169.254
  ipv6.metadata.301party.com: [::169.254.169.254]

Why not just one name with both A and AAAA records? ...er, and why not fd00:ec2::254? (I now suspect that there's a subjoke here that I'm missing)

bombcar•6mo ago

It can be nice to have an address that is guaranteed to be one or the other.

croemer•6mo ago

Couple of s/redirct/redirect typos

65•6mo ago

Can someone explain what this is?

Jeremy1026•6mo ago

A simple utility to test 301 redirects in your project.

arjvik•6mo ago

Also of interest: https://redirect.pizza/

rlk•6mo ago

I found a couple of fun tricks you can do with this (for some definition of "fun" anyway).

Go's http.Redirect function allows non-3xx statuses, and also renders a trivial page with a status message and link:

https://301party.com/451?url=javascript:alert(%27hello%27)

Alas not infinitely recursive but enough to make your browser give up:

https://301party.com/301?url=/301?url=/301?url=/301?url=/301...

[edit to add:] https://301party.com/0 causes a panic

Pyrodogg•6mo ago

I'm so used to getting 451's that the example flew right over my head. First reaction was, "ugh this again [reaches for vpn]".

We Mourn Our Craft

Hackers (1995) Animated Experience

Speed up responses with fast mode

Hoot: Scheme on WebAssembly

I Write Games in C (yes, C)

U.S. Jobs Disappear at Fastest January Pace Since Great Recession

SectorC: A C Compiler in 512 bytes

Stories from 25 Years of Software Development

OpenCiv3: Open-source, cross-platform reimagining of Civilization III

Al Lowe on model trains, funny deaths and working with Disney

The AI boom is causing shortages everywhere else

The Waymo World Model

Reinforcement Learning from Human Feedback

Brookhaven Lab's RHIC Concludes 25-Year Run with Final Collisions

Start all of your commands with a comma (2009)

Vocal Guide – belt sing without killing yourself

France's homegrown open source online office suite

Coding agents have replaced every framework I used

A Fresh Look at IBM 3270 Information Display System

Show HN: I saw this cool navigation reveal, so I made a simple HTML+CSS version

History and Timeline of the Proco Rat Pedal (2021)

Selection Rather Than Prediction

72M Points of Interest

Unseen Footage of Atari Battlezone Arcade Cabinet Production

Where did all the starships go?

Show HN: Look Ma, No Linux: Shell, App Installer, Vi, Cc on ESP32-S3 / BreezyBox

Learning from context is harder than we thought

Monty: A minimal, secure Python interpreter written in Rust for use by AI

Show HN: Kappal – CLI to Run Docker Compose YML on Kubernetes for Local Dev

Making geo joins faster with H3 indexes