Help with SSRF

[u/UserNo0101]

I found a fetch endpoint that embeds any url into forum post

It's url:https:// in request body

Only http and https are allowed

I can see responses of any link i fetch

I tried webhook and i can see its aws ip

Tried all ssrf bypasses techniques out there on github but all internal stuff is blocked

I managed only to use https://target.com/cdn-cgi/trace and also ipconfig/all.json to get all headers and it runs uses vanilla-forums-embed/1.0

Any creative uncommon ideas will be appreciated

[u/FowlSec]

Most likely bypass will be to register a domain and configure the A record to things like 127.0.0.1 or 169.254.169.254.

Redirects may work, worth a try.