Exploiting a Race Condition in a Daily Reward System to Gain Unlimited Wallet Balance

Concierge Briefing

Day 8 of the Hacker Holidays challenge focuses on a classic business logic vulnerability. Today we’ll abuse a race condition in a…

Room: Towel on the Sunbed (https://tryhackme.com/room/hh-towelonthesunbed-61271709) Platform: TryHackMe Difficulty: Medium Category: Web…

A rewards system let you claim 50 points every 24 hours. We claimed it three times in the same millisecond. Welcome to race conditions.

URL to the room: https://tryhackme.com/room/hh-towelonthesunbed-61271709

Room: Towel on the Sunbed (TryHackMe Hacker’s Holiday 2026)

Room: Towel on the Sunbed (TryHackMe Hacker’s Holiday 2026)

Step 1: Create a Guest Account

Users of anonymous operating systems typically rely on the guarantee that no single program running within the environment can betray their true identity. Sometimes, however, a solitary flaw in th…

https://tryhackme.com/room/hh-towelonthesunbed-61271709

Hello everyone, Today, I want to share two interesting race condition vulnerabilities that I discovered in a vulnerability disclosure…

TL;DR A researcher published a proof-of-concept exploit for a Linux kernel AF_PACKET race condition. The flaw enables local privilege escalation from an ordinary user to root. Upstream fixed it in…

A rewards system let you claim 50 points every 24 hours. We claimed it three times in the same millisecond. Welcome to race conditions.

30-Second Version: I analyzed 81 disclosed race condition reports from HackerOne and found 5 patterns that covered almost every report. The…

بسم الله الرحمن الرحيم
الحمد لله، والصلاة والسلام على رسول الله

When we hear race condition, most security researchers probably think about the usual suspects.

Introduction

While testing a web application I found a race condition in its project creation feature that allowed me to create nine projects with the…

In modern fintech and digital platforms, features like AI-powered chatbots aren’t just cool perks — they are massive cost drivers…