SSRF-XSS on makemytrip.com origin → session read → cross-origin mapi

running...