Easy
Business Logic Flaws
CoworkNow hidden-price tampering
A coworking day-pass booking site. The price is a hidden form field the server trusts as submitted.
PentestingHere Academy
Official Academy lab
- Attempts
- 2
- Solves
- 2
- Published
- 25 Aug 2026
Scenario
CoworkNow's day-pass checkout includes a hidden price field, set by the page's own JavaScript from the plan you picked, and submitted along with the booking.
Goal
Complete a day-pass booking charged at less than its real price (under $25). Do that and the confirmation reveals the flag.