Unprotected Admin Functionality

Lab#

Unprotected admin functionality · Apprentice

Solution#

Given#

This lab has an unprotected admin panel.

Solve the lab by deleting the user carlos.

Analyzing the task#

Short and clear: an unprotected admin panel. Delete the user carlos.

Recon#

Let's see what's going on. Worth paying attention to JS files and code. The site lists products — if we're talking admin, it makes sense to look at the product card.

Ah, looks like the wrong direction.

This is more about brute-forcing admin names:

1. Try /admin.
2. Check robots.txt.
3. Brute-force the admin path with a wordlist.

/admin didn't work, but robots.txt has a surprise:

Disallow: /administrator-panel

We go there — /administrator-panel. Delete the user. Lab solved!