Unprotected Admin Functionality | Apprentice
Just as the name implies, we are set out to look for an admin panel. Simply access robots.txt that they convieniently left for us:
From there we can delete the carlos user from the server.
Besides accessing robots.txt, we can also utilise the Site Map feature of Burp Suite as follow:
