[h1-415 2020] SSRF in a headless chrome with remote debugging leads to sensible information leak

Summary: Converter is using headless chrome with remote debbuging by rendring a page where we have out name, with which we can get xss leads to ssrf By using the remote debbugging with that ssrf we can grab the info all tabs in that chrome wher we can get even the flag document.

csp is allowing the script from https://raw.githack.com/mattboldt/typed.js/master/lib/, here  we can backtrack any url upto its root(/) and github is a open source.
So we can include js file in our github account using backtracking,. csp bypassed : )
The message