He used a combination of a shoot boot and a taunt = boot.

Then what he did was alter the hex in his browser and just found the correct address he needed, copy and pasted, then implemented the code.