> For the complete documentation index, see [llms.txt](https://itrp19-notes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itrp19-notes.gitbook.io/notes/reference/hacking/port-swigger/access-control/lab-unprotected-admin-functionality.md).

# Lab: Unprotected admin functionality

This lab has an unprotected admin panel. Solve the lab by deleting the user`carlos`.

<figure><img src="/files/ntH1wQ0uCmMMxb41BcPs" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/dFfi1Ar7uEzoriYNO9SA" alt=""><figcaption></figcaption></figure>

This is where I first tested [feroxbuster](https://github.com/epi052/feroxbuster); it functioned in PowerShell but was a little buggy; I then tested it in Kali and it performed flawlessly; the [word list](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/common.txt) was obtained from GitHub.

![](/files/ezus3Qom4hpcXpWMVYVK)

On robot.txt you see administrator-panel from the subdomain

<figure><img src="/files/gJbTldjbFXJ6BbsTSdy8" alt=""><figcaption></figcaption></figure>

At the administrator-panel you find the flag.