Bypassing domain deny_list rule in Smokescreen via double brackets [[]] which leads to SSRF