Find and Exploit Web Vulnerabilities on a Capture-the-Flag Range

Receive credentials to the CTF environment, the 8 challenge specifications (each with a target endpoint and a flag to extract), and the Rails source for the vulnerable app. For each challenge: identify the vulnerability class, write a working proof-of-concept (curl or Burp Suite request), extract the flag, and propose a concrete code-level fix (with diff if possible). Compile findings into a single penetration-test report formatted like a real engagement deliverable (executive summary, methodology, findings table, per-finding writeup with reproduction steps, recommended fix, references). Deliver the report, the curl/Burp-Suite collection of exploits, and a 1-page summary the hiring manager can skim.