[fake-dial] SSDP responder listening on 239.255.255.250:1900
[fake-dial] HTTP server listening on 0.0.0.0:8008
[fake-dial] POC page: http://localhost:8008/poc.html
[fake-dial] HTTP  127.0.0.1  GET  /dd.xml
[fake-dial] HTTP  127.0.0.1  GET  /poc.html
[fake-dial] HTTP  127.0.0.1  GET  /poc.html
[fake-dial] HTTP  127.0.0.1  GET  /favicon.ico
[fake-dial] M-SEARCH from 172.18.250.50:58536 -> replied LOCATION=http://172.18.250.50:8008/dd.xml
[fake-dial] M-SEARCH from 172.18.250.50:58536 -> replied LOCATION=http://172.18.250.50:8008/dd.xml
[fake-dial] HTTP  172.18.250.50  GET  /dd.xml
[fake-dial] ======================================================================
[fake-dial] >>> SSRF TRIGGERED <<<  GET /poc/ssrf-triggered
[fake-dial]     Origin header: 'package:Chromium.148.Linux'
[fake-dial]     User-Agent:    'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36'
[fake-dial]     The browser process fetched an arbitrary path outside /apps/ on a local-network device, driven by web content with no user gesture.
[fake-dial] ======================================================================
[fake-dial] HTTP  172.18.250.50  GET  /poc/ssrf-triggered
[fake-dial] M-SEARCH from 172.18.250.50:58536 -> replied LOCATION=http://172.18.250.50:8008/dd.xml
[fake-dial] M-SEARCH from 172.18.250.50:58536 -> replied LOCATION=http://172.18.250.50:8008/dd.xml