ParkPass permit portal (IDOR)
OF
1
A parking-permit portal addresses permits by a random token, but a directory API leaks everyone's token.
PentestingHere Academy
Official Academy lab
- Attempts
- 21
- Solves
- 18
- Published
- 6 Sep 2026
Scenario
ParkPass is a company parking-permit portal. Each permit is opened by a random,
unguessable token: /permit.php?ref=<token>. Because the token is random, you cannot
just change a number to reach someone else's permit.
Goal
Read the Facility Manager's permit and submit its gate code as the flag. The gate code appears in the "Gate code" field of the manager's permit page.