The question relied on the [web cache poisoning](https://portswigger.net/blog/practical-web-cache-poisoning).

Full writeup [here](https://lud1161.github.io/posts/hacker-movie-club-csaw-quals-2018/)

Original writeup (https://lud1161.github.io/posts/hacker-movie-club-csaw-quals-2018/).