We got a webpage :
Intercepted the request using burpsuite :
We found a /admin in robots.txt
While accessing the directory, we got the response as it only available to local users :
We changed the Host header to localhost and was able to access the admin panel :
We sent the request to delete the user carlos and solved the lab :
