Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Lab: Unprotected admin functionality with unpredictable URL

APPRENTICE

This lab has an unprotected admin panel. It's located at an unpredictable location, but the location is disclosed somewhere in the application.

Solve the lab by accessing the admin panel, and using it to delete the user carlos.

ACCESS THE LAB

Solution

  1. Review the lab home page's source using Burp Suite or your web browser's developer tools.
  2. Observe that it contains some JavaScript that discloses the URL of the admin panel.
  3. Load the admin panel and delete carlos.

Community solutions

Rana Khalil
Michael Sommer (no audio)

Register for free to track your learning progress

The benefits of working through PortSwigger's Web Security Academy

  • Practise exploiting vulnerabilities on realistic targets.

  • Record your progression from Apprentice to Expert.

  • See where you rank in our Hall of Fame.

Already got an account? Login here

Try Burp Suite for Free

Find access control vulnerabilities using Burp Suite

Try for free