Unprotected Admin Functionality with Unpredictable URL

🎯 Objective

This lab has an unprotected admin panel, but its location is unpredictable.
The hidden location is disclosed somewhere within the application.

Goal:

• Locate the admin panel.
• Use it to delete the user carlos.

🧭 Strategy

When the admin panel isn’t at a predictable path (like /admin), look for indirect clues in the application.

Possible places to check:

• HTML source comments
• JavaScript files
• Error messages
• Internal links not visible in the UI

🔎 Analysis

1. Source Code Inspection

• Opened the page source (Ctrl+U)
• Searched for keywords like href="/admin-*", <!-- hidden admin -->
• Found references pointing to a hidden admin path.

2. Static File Review

• Checked linked resources (.js, .css)
• Looked for fetch calls or unused references revealing admin URLs.

3. Path Disclosure Patterns

• Looked for debug variables or console logs.
• Found /admin-randomstring style path inside the HTML/JS.

4. Testing

• Navigated directly to the discovered path.
• Confirmed the hidden admin panel was accessible.

🚀 Discovery Process

1. Checked /robots.txt → no useful data.
2. Inspected base HTML source → discovered clue referencing admin panel.
3. Followed hidden link → located the real admin endpoint.

📝 Action Plan

1. Locate hidden admin path (via HTML or JS).
2. Navigate directly to that endpoint.
3. Use the admin functionality to delete user carlos.

📸 Screenshots

Step 1: HTML source inspection

Step 2: Found admin path

Step 3: Accessing admin functionality

🎉 Result

• Located the hidden admin panel.
• Accessed functionality without authentication.
• Deleted user carlos successfully. ✅