Without even being logged in, we were able to force browse to an area of the web application that was unmapped. The term unmapped means the application itself had no direct link to this secret configuration page. However, using Burp Intruder and a wordlist containing commonly known administration file names, we were able to discover the page using the directory traversal attack.