Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Towel on the Sunbed

Ponzi set his towel down for one 24-hour reward claim. He came back to find the sunbed had been "claimed" three times over while he wasn't looking.

Task 1: Web Hacker Holidays: Day 8

 
 
 
Hacker Holidays ยท The Byte Lotus Hotel
Towel on the Sunbed
  ๐Ÿš  
๐Ÿš
 
 
 
 
 
 
๐ŸŒด
๐ŸŒด
๐Ÿฅฅ
๐Ÿฅฅ
๐Ÿฆ
๐Ÿน
 
Points
90
Category
Web
Difficulty
Medium
 
๐Ÿ›Ž๏ธ Concierge Briefing

Ponzi found the resort's wellness portal running a little side project called Ponzi โ€” a crypto rewards app, poolside edition. He set his towel down, claimed his daily reward, and went to reapply sunscreen. He came back to find the sunbed had been "claimed" three times over while he wasn't looking.

He's convinced the app owes him a spot in the Whale Vault. The app disagrees, politely, once every 24 hours. Somewhere between his request and the server's clock, there's a gap wide enough to walk a whale through.

๐Ÿ—๏ธ ROOM ACCESS
Lab Machine
http://MACHINE_IP:3000
App
Ponzi โ€” Wellness Rewards
๐Ÿ–๏ธ TODAY'S ITINERARY
 Create a guest account and explore Ponzi's daily reward mechanism.
 Work out exactly what's standing between you and Whale Vault status.
 Find your way past it and retrieve the flag from the vault.
๐Ÿ“ธ @0xMia's STORY
  @0xMia ยท posted 40 min after room unlock

"ponzi guy has been refreshing his dashboard for an HOUR waiting on this timer ๐Ÿ’€ bro really thinks the clock is the only thing checking him #HackerHolidays"

Web Exploitation Business Logic Burp Suite API Abuse

Answer the questions below

  1. What is the flag?

Room Icon

Towel on the Sunbed

Ponzi set his towel down for one 24-hour reward claim. He came back to find the sunbed had been "claimed" three times over while he wasn't looking.

medium

45 min

11,235

User profile photo.
User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Hacker Holidays 2026 - Day 8 - Towel on the Sunbed
Source: YouTube

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off
 
 
 
Hacker Holidays ยท The Byte Lotus Hotel
Towel on the Sunbed
  ๐Ÿš  
๐Ÿš
 
 
 
 
 
 
๐ŸŒด
๐ŸŒด
๐Ÿฅฅ
๐Ÿฅฅ
๐Ÿฆ
๐Ÿน
 
Points
90
Category
Web
Difficulty
Medium
 
๐Ÿ›Ž๏ธ Concierge Briefing

Ponzi found the resort's wellness portal running a little side project called Ponzi โ€” a crypto rewards app, poolside edition. He set his towel down, claimed his daily reward, and went to reapply sunscreen. He came back to find the sunbed had been "claimed" three times over while he wasn't looking.

He's convinced the app owes him a spot in the Whale Vault. The app disagrees, politely, once every 24 hours. Somewhere between his request and the server's clock, there's a gap wide enough to walk a whale through.

๐Ÿ—๏ธ ROOM ACCESS
Lab Machine
://MACHINE_IP:3000
App
Ponzi โ€” Wellness Rewards
๐Ÿ–๏ธ TODAY'S ITINERARY
 Create a guest account and explore Ponzi's daily reward mechanism.
 Work out exactly what's standing between you and Whale Vault status.
 Find your way past it and retrieve the flag from the vault.
๐Ÿ“ธ @0xMia's STORY
  @0xMia ยท posted 40 min after room unlock

"ponzi guy has been refreshing his dashboard for an HOUR waiting on this timer ๐Ÿ’€ bro really thinks the clock is the only thing checking him #HackerHolidays"

Web Exploitation Business Logic Abuse
Answer the questions below

What is the flag?