Public shop

This back-end sits behind a real HAProxy reverse proxy. The proxy blocks /admin — try it and you get 403. Smuggle a request past the proxy to reach it. Exploit with a raw request (nc), not this browser.