Authorization disclaimer. This walkthrough is exclusively for the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Only test systems you own or are explicitly authorized to assess.

Overview

The application replaces a familiar admin path with a randomized one, but does not protect it with server-side authorization. Public JavaScript contains the route, so any visitor can recover it.

PortSwigger unpredictable admin URL lab introduction
The lab frames obscurity as the only barrier to an admin panel.

Lab objective/setup

With no credentials, find the panel and delete the synthetic carlos account.

What I observed

robots.txt did not provide a useful path. Inspecting the page’s client-side source instead revealed /admin-sok4dr embedded in JavaScript.

Robots.txt not revealing an admin path
The initial /robots.txt check does not expose the adminPanelTag route.
Client-side JavaScript containing the randomized admin route
Public JavaScript discloses the randomized administrative path assigned to adminPanelTag.

Why it is vulnerable

Everything delivered to a browser is observable by the user. A secret URL cannot establish identity or privilege, and this route has no independent authorization gate.

Walkthrough in the authorized PortSwigger lab

  1. Inspect the home page source or loaded JavaScript.
  2. Identify /admin-sok4dr, request it directly, and confirm the panel is accessible.
  3. Delete carlos using the provided control.
Unprotected randomized administrator panel
The recovered URL opens the admin panel without authorization.
PortSwigger lab solved after deleting Carlos
The solved banner confirms completion after deleting carlos through the disclosed route.
Inspect the home-page JavaScript, copy the path assigned to `adminPanelTag`, open that exact route, and use its Carlos deletion control. Confirm the solved banner only after the authorized action.

Verification

The solved banner confirms the action. Reaching the panel in a fresh unauthenticated session demonstrates that possession of the URL is the only control.

Impact and defensive lesson

Obscure routes may reduce accidental discovery, but they provide no authorization. Require a validated session and appropriate server-side role on every admin endpoint.

References