Dns-Rebinding

A Money Heist–themed Flask app hides a flag split into three fragments behind a server-side URL fetcher, bypassed with a DNS-based SSRF to reach the internal API and a privileged file-read endpoint.

A Flask meal-notification SSRF whose is_global filter is defeated by abusing urllib3’s retry-driven DNS re-resolution — a global IP that hangs on port 80 (8.8.8.8) outlasts dnsmasq’s 2s cache, so the retry re-resolves to 127.0.0.1 and reaches the localhost-only /vip-meal.