> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-2.md).

# lab-2

## Unprotected Admin Functionality with Unpredictable URL

**Difficulty:** Apprentice

### Lab Description

This lab has an unprotected admin panel at an unpredictable URL, but the URL is accidentally disclosed somewhere in the application's client-side code.

**Objective:** Access the admin panel and delete the user `carlos`.

### Solution

**Step 1 — Find the disclosed admin URL in the page source**

Open the main lab page and view the page source (right-click → **View page source**, or use browser DevTools). Search for the keyword `admin`.

A JavaScript block is present that checks whether the current user is an admin (`isAdmin`). If they are, it dynamically builds a navigation element containing a link to the admin panel. The `href` attribute of that link contains the actual admin panel URL path — even though the UI element is only rendered for admins, the JavaScript containing the path is sent to every visitor.

**Step 2 — Access the admin panel and delete carlos**

Copy the admin URL path from the source and navigate to it directly in the browser. The panel loads without any authentication or access check. Delete the user `carlos` to complete the lab.

### Conclusion

Hiding a URL by making it "unpredictable" provides no real security when the path is embedded in client-side JavaScript that is served to all users. Security through obscurity is not a substitute for proper server-side access control. This is another example of **vertical privilege escalation** — the sensitive functionality had no server-side enforcement, only a UI-level visibility check.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-2.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.