A SQLi login bypass and a Node preview route that require()s uploads into RCE, then loot on disk and a leaky APK carry the foothold clean through a pivot to Domain Admin.

Proxy's mirror image: crack a KeePass vault, then write your own delegation right onto the DC and S4U to SYSTEM.

Every request goes through someone, be that someone, and constrained delegation hands you the DC.