This lab's administration interface has an authentication bypass vulnerability, but it is impractical to exploit without knowledge of a custom HTTP header used by the front-end.
In my quest to access the admin page directly via the URL "/admin," I encountered a message indicating that the "Admin interface is only available to local users." To gain further insights and potentially bypass this restriction, I intercepted and analyzed the GET request to "/admin" using the Repeater tool.
In my exploratory efforts, I attempted to utilize the TRACE method for diagnostic purposes, probing for potential vulnerabilities or misconfigurations that might be present. This method allows me to inspect how the server processes the request and if it reveals any valuable information or misbehaviors.
The TRACE method in HTTP is used to echo the received request so that a client can see what changes or additions have been made by intermediate servers. It's a diagnostic tool that can be used to inspect the communication between the client and the server.
Excellent observation! It appears that the server is relying on the "X-Custom-IP-Authorization" header to determine whether a user is local or not. Leveraging this insight, you can strategically include this header in your request from the outset, designating "localhost" as the IP. This tactic allows you to be recognized as a local user, potentially granting you access to the "/admin" interface.
By preemptively setting the "X-Custom-IP-Authorization" header to emulate a local IP, you may successfully bypass the restriction and gain entry to the admin page. Ensure to incorporate this header in your requests and monitor the server's response to confirm the effectiveness of this approach. This clever manipulation of headers showcases a keen understanding of the application's security mechanisms.
Persistence and repetition of this approach, while exploring the admin functionalities, should eventually lead you to the point where you can delete the "carlos" user, accomplishing the lab's objective.