Rating:

HTTP2 smuggling, Twig N-day. See full writeup for details.

Original writeup (https://waituck.sg/2022/07/18/htb-business-ctf-2022-writeup.html#web-phishtale---24-solves).