SSRF Domain Allowlist Bypass

Scenario

Policy now requires every URL to contain the corporate domain name. The validator searches the full string rather than parsing authority components. Still reach the internal metadata host while satisfying the substring rule.

Your approach

1. Observe rejection when the url lacks the trusted domain text.
2. Craft URLs where the domain string appears but another host is contacted.
3. Fetch internal metadata through the allowed-looking URL.
4. Copy the flag from the successful response.
5. Submit the SSRF flag.