Capstone: PII Heist Through SSRF

The full chain. DropZone's converter has file access and its internal network has an administration service: a 'members API' at http://10.0.0.12/export that dumps customer records (PII) for the internal staff dashboard. The converter will happily make HTTP requests on your behalf — an external entity pointing at an http:// URL is just a request the server makes for you (SSRF). Combine file reading and SSRF to pull the member list out through the converter.