1. *Recon: /robots.txt → /search. SQLi (UNION):* dump the admin MD5 from the users table via /search?q=x' UNION SELECT 1,pass,3 FROM users-- .
2. *Crack: the MD5 is password (dictionary). Login:* at /login as admin.
3. *SSRF:* the admin panel's URL-preview fetches server-side; hit http://127.0.0.1:9000/ to reach the internal service, which returns the flag.
4. Complete REPORT_TEMPLATE.md documenting each finding, impact and fix. solve.py automates the technical chain.
Lesson: real engagements chain many small issues — and the report is the deliverable that drives remediation.