---
description: >-
  https://portswigger.net/web-security/access-control/lab-unprotected-admin-functionality
---

# Unprotected admin functionality

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F28oCcKWVaYLCAtO5z7TL%2F1.png?alt=media&#x26;token=d4680540-b4b8-4024-9055-91007026e3cb" alt=""><figcaption></figcaption></figure>

We can go to the `/robots.txt` file to check is any pages are disallowed for web crawler.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fh4BXGY9smQfka5DJ9smw%2F2.png?alt=media&#x26;token=eb9804ac-5cb8-47c5-bce0-6fe162fecb96" alt=""><figcaption></figcaption></figure>

As we can see, the `/administrator-panel` page is blocked. Let's visit it through the browser.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fe6tJ1ETjDOZllY3JQcK0%2F3.png?alt=media&#x26;token=54183ebf-78e4-46e8-bcb2-6f5c9f3f07db" alt=""><figcaption></figcaption></figure>

We can now delete the `carlos` user.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F6T46Yzu7jxmALTvwWOaA%2F4.png?alt=media&#x26;token=2a1c8e55-03b7-4dc0-b855-f2f739bfe045" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FKVR2MJgujJBnRNuIQH8o%2F5.png?alt=media&#x26;token=91f52af2-6f57-4790-9431-2bf57a4cac9d" alt=""><figcaption></figcaption></figure>
