My first RCE: a tale of good ideas and good friends

Joseph Thacker recounts his first RCE and first critical: spraying SSRF parameter payloads with meg across 600,000+ public bug bounty hosts, catching callbacks on a bare python http.server, then isolating the vulnerable host and parameter with split and grep.