Rating: 0

https://github.com/p4-team/ctf/tree/master/2018-11-24-asis-finals/re_gunshop#gunshop-2-web-304p-8-solved

tl;dr: spoof the callback endpoint to your own