skills.rest
hhjkjkjk
hhjkjkjkCOMMUNITY
Explore all skills by this author →
GitHub

hunt-business-logic

Detects business logic vulnerabilities in payment, verification, and checkout flows using bug bounty methodologies.

Updated May 29, 2026
Search Tags:#payment security#penetration testing#race condition#business logic#bug bounty#price tampering#webhook forgery
One-click install
npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-business-logic-hhjkjkjk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-business-logic
Source: https://github.com/hhjkjkjk/Claude-skills/tree/main/skills/hunt-business-logic
Command: npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-business-logic-hhjkjkjk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security researchers and bug bounty hunters often miss high-impact business logic flaws because they lack a structured methodology for testing payment flows, verification gates, and rate limits beyond standard injection scanning. ## Core Features & Use Cases - Attack Surface Mapping: Identifies crown-jewel targets (checkout flows, payment webhooks, internal portals) via URL patterns, JS bundle analysis, and response header signals. - Step-by-Step Hunting Methodology: Provides a 7-step workflow covering authentication boundary mapping, verification flow testing, rate-limit probing, and in-flight payment tampering with Burp Suite. - Real-World Case Library: Includes 12 disclosed HackerOne reports (Stripe, Reverb, Upserve, Krisp) with payloads, root causes, and bounty amounts for pattern matching. - Use Case: While testing an e-commerce target, use the negative-quantity and price-tampering payload patterns to check whether the server validates cart quantities and re-computes prices server-side before payment capture. ## Quick Start Ask the AI to apply the business logic hunting methodology to map and test the checkout and payment verification flows of your authorized bug bounty target.

Frequently Asked Questions about hunt-business-logic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find business logic vulnerabilities in bug bounty programs?▼

Map authentication boundaries and verification flows first, then test each step for skips, replays, and client-trusted values. Focus on checkout flows, payment webhooks, and rate-limited forms where server-side validation is often missing.

How to test payment flows for price tampering vulnerabilities?▼

Intercept requests between the application and payment provider with Burp Suite, then modify amount, currency, or order ID fields. Also test webhook endpoints for missing HMAC signature validation by posting fake success confirmations.

What are common business logic bug types with financial impact?▼

High-impact types include negative-quantity cart manipulation, coupon or gift-card race-condition multi-redemption, price-per-unit mass assignment, archived-price swaps at checkout, and client-side checkout amount trust on payment redirects.

Does rate limit bypass via X-Forwarded-For headers still work?▼

Yes, when servers read the client IP from spoofable headers like X-Forwarded-For, X-Real-IP, or CF-Connecting-IP instead of the connection IP. Rotating these headers per request can defeat IP-based rate limiting on login, OTP, and subscription endpoints.

When should a business logic finding be rejected before reporting?▼

Reject it if you cannot state what the attacker can concretely do, what the victim loses, or reproduce the full chain in under 10 minutes from a fresh account. Theoretical impact without demonstrable financial, privacy, or access loss fails the Gate 0 validation.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
venkatasvenkatas

report-writing

Generate bug bounty reports with impact-first language and CVSS scoring templates.

Community
Advanced
jd-opensourcejd-opensource
299

pentest-race-conditions

Identify and reproduce race conditions and TOCTOU vulnerabilities in web applications.

Official
Advanced
dreadnodedreadnode
11

burp-suite

Automate Burp Suite Professional security testing via its MCP server.

Official
Intermediate