QuickCourt reset-code takeover
A padel and tennis court booking site. The reset code is derived from the send time, with no rate limit.
PentestingHere Academy
Official Academy lab
- Attempts
- 1
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
QuickCourt emails a 6-digit password reset code. Nothing rate-limits how many codes you can try.
Goal
Take over the account coach_martinez through its password reset. Once you are in, the flag is the note on that account's dashboard.