SSRF behind a substring allowlist

/allowlist · sink: requests.get

Only fetches if the URL 'contains' vulnlab.dev — which the validator checks the wrong way.

Hint

The check is `'vulnlab.dev' in url`. The trusted token doesn't have to be in the host. Try a path or query string.