Unprotected admin functionality

🎯 Objective

This lab contains an unprotected admin panel.

Goal:

• Access the admin panel.
• Delete the user carlos.

🧭 Strategy

As part of reconnaissance, check the robots.txt file.
Although it is meant to guide search engine crawlers, it often discloses hidden or sensitive directories.

🔎 Analysis

1. Recon: robots.txt

• Navigated to /robots.txt.
• Found disallowed path:

User-agent: *
Disallow: /administrator-panel

This revealed the hidden admin panel endpoint.

2. Directory Guessing / Bruteforcing

• Common paths to test include: /admin, /administrator, /backend, /cms, /manage.
• In this case, /administrator-panel was disclosed directly.

3. Check for Authentication Bypass

• Accessed /administrator-panel.
• No authentication required.
• Admin panel loaded successfully.

4. Review Page Functionality

• Located user management features.
• Identified option to delete users.

🚀 Discovery Process

1. Accessed /robots.txt:
   robots.txt link

2. Discovered hidden path: /administrator-panel.

3. Navigated to /administrator-panel directly in browser.

4. Located user management section and deleted carlos.

📸 Screenshot

🎉 Result

• Found hidden admin panel via robots.txt.
• Accessed /administrator-panel.
• Deleted user carlos successfully. ✅