Generate two wordlists where attacker and allowed hostnames replaced by default

[d0ge]

Original message by @SeanPesce

I'm not sure if it really matters, but currently it looks like only the open redirect payload is included:

        {
            "payload": "<allowed>[@<attacker>",
            "description": "Spring Framework CVE-2024-22243 <allowed>[@<attacker>",
            "filters": [],
            "tags": ["URL", "HOST"],
            "id": "1da2f627d702248b9e61cc23912d2c729e52f878"
        },
This would probably fail on most SSRF-vulnerable implementations unless the user tries to swap the positions of <allowed> and <attacker>. For completeness and one-shot list generation, it might be worth adding the other version of the payload too (<attacker>[@<allowed>).