SSRF behind a substring blocklist

/blocklist · sink: urllib.request.urlopen

Rejects URLs containing 'localhost' or '127.0.0.1', then fetches.


Hint

Same internal target as /basic. The validator only checks for the literal strings 'localhost' and '127.0.0.1'. Find another way to spell that address.

View source for this lab →