Broken Access Control – Unprotected Admin Functionality Leading to Privilege Escalation | Unprotected Admin Functionality

Overview

This lab demonstrates a classic case of broken access control, where sensitive administrative functionality is exposed without authentication.

An attacker can directly access privileged endpoints and perform critical actions without logging in.

---

Objective

• Access the admin panel
• Delete the user carlos

---

Reconnaissance

Step 1: Inspect robots.txt

/robots.txt

Observation

The file reveals a hidden administrative endpoint:

/administrator-panel

Evidence

This suggests the presence of an admin interface that may not be properly secured.

---

Exploitation

Step 2: Access Admin Panel

Navigate to:

/administrator-panel

Evidence

No authentication is required to access the panel.

---

Step 3: Perform Administrative Action

• Accessed the admin interface
• Navigated to user management
• Deleted user carlos

---

Proof of Exploitation

Result

• Admin panel accessible without authentication
• User carlos successfully deleted
• Lab marked as solved

---

Impact

This vulnerability can lead to:

• Unauthorized administrative access
• Data manipulation or deletion
• Full system compromise

---

Mitigation

To prevent this issue:

• Enforce authentication on all admin endpoints
• Implement proper Role-Based Access Control (RBAC)
• Avoid exposing sensitive paths in /robots.txt
• Use server-side authorization checks (not just hidden URLs)

---

Real-World Insight

Relying on hidden endpoints for security is ineffective. Attackers routinely enumerate paths using:

• /robots.txt
• JavaScript files
• Directory brute-forcing tools

Security must always be enforced through proper access control, not obscurity.

---