I was reading an article about Server-Side Request Forgery. In that article the attacker found that
127.0.0.1 was open to the internet. The victim then blocked
127.0.0.1, but because many other IPs and apparently also some domains are also resolved to to that, including the mysterious
localtest.me, he was able to bypass a weak text-based filter.
What is so special about
Are there others? (And how to find them?)
I found: http://readme.localtest.me/
Apparently someone decided to register that domain in a funny way, for testing purposes:
Here’s how it works. The entire domain name localtest.me—and all wildcard entries—point to 127.0.0.1. So without any changes to your host file you can immediate start testing with a local URL.
However, I'm still not sure how you can register an external domain to a local one. This is confusing as a
tracert localtest.me never even leaves the machine. How is this handled on the low level?
I then found several more in these comments and elsewhere:
lvh.me vcap.me fuf.me - IPv4 and IPv6 ulh.us 127-0-0-1.org.uk ratchetlocal.com smackaho.st 42foo.com beweb.com yoogle.com ortkut.com feacebook.com