Log in to website using info leak in an internal route, and use query-parameter-injection to pollute locals.

BTW Always look at robots.txt :thumbs:.