Ssrf

A URL fetcher checked that the host was not internal, then fetched it, so a DNS rebind flipped the name to localhost between the two steps.

A link-checker with a local SSRF, reachable at 127.0.0.1:5000/flag. Non-deterministic and not dockerized, the most disliked challenge of the event.

A URL-preview endpoint that fetched any address and handed back a chosen element, which made it a clean SSRF into the internal network and cloud metadata.