hunt-business-logic
Identifies business logic vulnerabilities in financial transactions, enhancing security for e-commerce and SaaS platforms.
Install this skill
Security score
The hunt-business-logic skill was audited on Jun 10, 2026 and we found 28 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Curl to non-GitHub URL
| 73 | curl -s -X POST https://target.com/api/subscribe \ |
Curl to non-GitHub URL
| 91 | curl -X POST https://target.com/payment/callback \ |
Curl to non-GitHub URL
| 99 | curl -s https://target.com/robots.txt | grep -iE "(disallow|allow)" |
Curl to non-GitHub URL
| 100 | curl -s https://target.com/sitemap.xml | grep -iE "(employee|internal|staff|summit|admin)" |
Curl to non-GitHub URL
| 103 | curl -s https://target.com/assets/app.js | grep -oE '"/[a-zA-Z0-9/_-]{3,50}"' | sort -u |
Curl to non-GitHub URL
| 110 | curl -s -X POST https://monitor.target.com/api/monitoring/enable \ |
Curl to non-GitHub URL
| 116 | curl -X POST https://target.com/verify \ |
Fetch to external URL
| 39 | - `fetch('/api/subscribe', { method: 'POST', body: ... })` with no anti-CSRF token or rate-limit token |
Webhook reference - potential data exfiltration
| 17 | Asset types that pay: checkout flows, subscription endpoints, callback/verification systems, webhook handlers, employee/internal portals exposed to the internet, and any endpoint that trusts client-su |
Webhook reference - potential data exfiltration
| 26 | - `/api/v*/payment`, `/api/v*/notify`, `/webhook` — payment provider callbacks |
Webhook reference - potential data exfiltration
| 44 | - Payment webhooks with no HMAC signature validation |
Webhook reference - potential data exfiltration
| 57 | 4. **Intercept and tamper with payment flows.** Use Burp Suite to intercept every request between your browser, the application, and the payment provider. Identify where price, currency, order ID, or |
Webhook reference - potential data exfiltration
| 90 | # Look for unvalidated webhook endpoints |
Webhook reference - potential data exfiltration
| 142 | 4. **Payment webhooks lack signature validation.** Developers implement "success" webhooks without verifying the HMAC signature provided by the payment provider, allowing anyone to POST a fake success |
Webhook reference - potential data exfiltration
| 160 | | Webhook HMAC validation | Test with no/empty signature header (is validation enforced at all — a modified payload only "passes" if it isn't); replay an UNMODIFIED captured webhook to test missing id |
Webhook reference - potential data exfiltration
| 187 | A payment flow passed order amount and currency through client-controlled parameters before redirecting to a third-party payment provider (Smart2Pay). By intercepting the redirect with Burp Suite and |
External URL reference
| 73 | curl -s -X POST https://target.com/api/subscribe \ |
External URL reference
| 91 | curl -X POST https://target.com/payment/callback \ |
External URL reference
| 99 | curl -s https://target.com/robots.txt | grep -iE "(disallow|allow)" |
External URL reference
| 100 | curl -s https://target.com/sitemap.xml | grep -iE "(employee|internal|staff|summit|admin)" |
External URL reference
| 103 | curl -s https://target.com/assets/app.js | grep -oE '"/[a-zA-Z0-9/_-]{3,50}"' | sort -u |
External URL reference
| 110 | curl -s -X POST https://monitor.target.com/api/monitoring/enable \ |
External URL reference
| 116 | curl -X POST https://target.com/verify \ |
External URL reference
| 198 | 8. **Stripe — Fee discount race redemption** ([H1 #1849626](https://hackerone.com/reports/1849626)) |
External URL reference
| 204 | 9. **Reverb.com — Gift-card race multi-redemption** ([H1 #759247](https://hackerone.com/reports/759247)) |
External URL reference
| 210 | 10. **Upserve / OLO — Negative-quantity price manipulation** ([H1 #364843](https://hackerone.com/reports/364843)) |
External URL reference
| 216 | 11. **Krisp — Pay-less-per-seat via PUT tampering** ([H1 #1446090](https://hackerone.com/reports/1446090)) |
External URL reference
| 222 | 12. **Stripe — Pay using archived price via mid-flow swap** ([H1 #1328278](https://hackerone.com/reports/1328278)) |