If you were attacking a local webapp interface instead of a non-http daemon like redis, you would need your browser to be able to access the web service. At that point, this kind of attack would still allow an attacker to also access that web service.
Doesn't have to be SELinux, any of the frameworks will do. Or run it in a new network namespace.