If I was able to view any page on a website as localhost using SSRF, what files should I check for? I checked to see if I could view robots.txt normally, and I couldn't, but using SSRF, I was able to. What other files are typical on websites that are normally hidden to the public, but would be visible on the localhost?
In a Microsoft environment, your best bet is probably the trace.axd file. This is often enabled and is set to local only so you would be able to access it from localhost.
This tracing info can include lots of debugging material, developer output and environment configuration data.