1. Web Security Academy
  2. Access control
  3. Lab

Lab: Unprotected admin functionality with unpredictable URL

APPRENTICE

This lab has an unprotected admin panel. It's located at an unpredictable location, but the location is disclosed somewhere in the application.

Solve the lab by accessing the admin panel, and using it to delete the user carlos.

Try Burp Suite for Free

Find access control vulnerabilities using Burp Suite

Try for free