June 3, 2026

PortSwigger Lab: Unprotected admin functionality

This lab has an unprotected admin panel.

Ramkumar

Author

Solve the lab by deleting the user carlos.

This is an easy lab.

Step 1: Access the lab

Step 2: Append your URL to /robots.txt you probably see a disallow: /administrator-panel

Step 3: Insert the /administrator-panel into your URL the page will redirect to a admin page where you can remove user accounts.

Step 4: Delete carlos account

Step 5: That's it lab solved.

Follow fore more wirteups!