[homakov]

> SSRF is an extremely bad vulnerability; it's usually game-over on penetration tests

It's usually not. What can you do via HTTP protocol inside the network? Check out ssrf bible.

[greenleafjacob]

You can smuggle memcached text protocol over HTTP if you can insert a linefeed. I think tptacek meant "bad vulnerability" as in serious, not trivial.

[homakov]

SSRF usually happens inside a request library that doesn't allow linefeeds. SSRF in general is serious, but HTTP GET SSRF is useless on most hosts.