DriveShare booking IDOR
A peer-to-peer car rental app. Find a way to read another user's booking.
PentestingHere Academy
Official Academy lab
- Attempts
- 24
- Solves
- 23
- Published
- 25 Aug 2026
Scenario
DriveShare lets people rent out their own cars to nearby renters. After you book a car, you can view your booking's details, such as pickup code and renter phone number, at /booking.php?id=.
Goal
Read the booking that belongs to another renter, sofia_m, not the one seeded to your own account. Her booking's pickup code is the flag.