On this page
apsyleg1 min read
#portswigger #access-control #web-security

Unprotected Admin Functionality

Lab

Unprotected admin functionality · Apprentice

Solution

Given

This lab has an unprotected admin panel.

Solve the lab by deleting the user carlos.

Analyzing the task

Short and clear: an unprotected admin panel. Delete the user carlos.

Recon

Let's see what's going on. Worth paying attention to JS files and code. The site lists products — if we're talking admin, it makes sense to look at the product card.

Ah, looks like the wrong direction.

This is more about brute-forcing admin names:

  1. Try /admin.
  2. Check robots.txt.
  3. Brute-force the admin path with a wordlist.

/admin didn't work, but robots.txt has a surprise:

Disallow: /administrator-panel

We go there — /administrator-panel. Delete the user. Lab solved!

More in this category

Arbitrary Object Injection in PHP (PortSwigger Lab)

Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.

Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)

Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.

Modifying Serialized Data Types (PortSwigger Lab)

Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.