Break SafeCurl and get 0.25 Bitcoin

The developer with the nickname fin1te writes a secure wrapper over curl , which helps protect against SSRF attacks, and in this regard holds a contest: if you can download the btc.txt file, which is located on the SafeCurl safecurl.fin1te.net demo server and is only available with source IP 127.0.0.1 and 37.48.90.196 (external server IP), then you will get access to the wallet containing B-0.25.

Already made 3 successful hacking:

• @zoczus bypassed the protection by going on 0.0.0.0/btc.txt
• @ 47696d6569 and ryanc did DNS rebinding, which allowed them to download a file from a different IP address, after passing through validation
• @shDaniell used a vulnerability in parsing a URI by downloading a file with a link like user:pass@safecurl.fin1te.net?@google.com/

If you managed to download btc.txt, the author asks you to describe a way of hacking to his mail.
')
Contest page .