Defeat SSRF allow-lists with DNS rebinding

When the server validates a hostname then fetches it separately, a TTL-0 record that flips to an internal IP wins the race between the two lookups.