{"id":2609,"date":"2026-10-31T12:55:08","date_gmt":"2026-10-31T12:55:08","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2609"},"modified":"2026-10-31T12:55:10","modified_gmt":"2026-10-31T12:55:10","slug":"portswigger-access-control-lab-1-unprotected-admin-functionality","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/10\/31\/portswigger-access-control-lab-1-unprotected-admin-functionality\/","title":{"rendered":"PortSwigger Access Control Lab 1: Unprotected Admin Functionality"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Bu labda, PortSwigger Web Security Academy\u2019nin Access Control kategorisindeki \u201cUnprotected admin functionality\u201d senaryosunu inceliyoruz. Uygulaman\u0131n robots.txt dosyas\u0131 y\u00f6netim panelinin yolunu a\u00e7\u0131\u011fa \u00e7\u0131kar\u0131yor ve bu panelde eri\u015fim kontrol\u00fc bulunmad\u0131\u011f\u0131 i\u00e7in y\u00f6netici i\u015flevlerine do\u011frudan eri\u015filebiliyor. Amac\u0131m\u0131z, y\u00f6netim panelini bulmak ve carlos kullan\u0131c\u0131s\u0131n\u0131 silerek lab\u0131 \u00e7\u00f6zmek. <a href=\"https:\/\/portswigger.net\/web-security\/access-control\/lab-unprotected-admin-functionality\">Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bir gizli panel bulmam\u0131z bizden istenmi\u015fti. Arka planda Gobuster&#8217;\u0131 ba\u015flatt\u0131m ve temel tarama i\u015flemlerini de ba\u015flatm\u0131\u015ft\u0131m. Nikto vb. gibi. Nikto benim i\u00e7in bir robots.txt buldu. Sayfaya gitti\u011fimizde zaten bizim i\u00e7in nokta at\u0131\u015f\u0131 olan bir link var.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1075\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-57.jpeg\" alt=\"\" class=\"wp-image-2610\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-57.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-57-768x645.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Lab\u0131 bu \u015fekilde \u00e7\u00f6zebilirsin.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1075\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-58.jpeg\" alt=\"\" class=\"wp-image-2611\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-58.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-58-768x645.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Bu labda, PortSwigger Web Security Academy\u2019nin Access Control kategorisindeki \u201cUnprotected admin functionality\u201d senaryosunu inceliyoruz. Uygulaman\u0131n robots.txt dosyas\u0131 y\u00f6netim panelinin yolunu a\u00e7\u0131\u011fa \u00e7\u0131kar\u0131yor ve bu panelde&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/10\/31\/portswigger-access-control-lab-1-unprotected-admin-functionality\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">PortSwigger Access Control Lab 1: Unprotected Admin Functionality<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[752],"class_list":["post-2609","post","type-post","status-publish","format-standard","hentry","category-web","tag-access-control","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2609","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2609"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2609\/revisions"}],"predecessor-version":[{"id":2612,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2609\/revisions\/2612"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}