hunt-business-logic

Identifies pricing and checkout business-logic vulnerabilities in financial transaction workflows.

3.3k|507|Updated May 5, 2026

Search Tags:#vulnerability #checkout #business-logic #TOCTOU #security-research #bug-bounty #price-tampering

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-business-logic-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-business-logic
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-business-logic
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-business-logic-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Business logic vulnerabilities in pricing and checkout flows can cause revenue loss, fraud, and unauthorized behavior. This Skill guides security researchers to identify and demonstrate real-world impacts from such flaws in a repeatable, safe manner.

Core Features & Use Cases

Detect coupon-race stacking, negative-quantity price manipulation, decimal/fraction price-field overflow, client-side price trust, and archived-price TOCTOU across ecommerce and SaaS platforms.
Provide end-to-end hunting methodology with concrete real-world case references to quantify impact and reproduce chains responsibly.
Offer guidance on responsible disclosure, risk assessment, and remediation prioritization for business-impacting flaws.

Quick Start

Identify a target platform and reproduce an end-to-end business-logic vulnerability from discovery to impact in pricing, discounts, and checkout flows.

Frequently Asked Questions about hunt-business-logic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find business logic vulnerabilities in ecommerce checkout flows?▼

To find business logic vulnerabilities in checkout flows, you test for coupon race conditions, price tampering, negative-quantity manipulation, and price-based TOCTOU across payment and SaaS platforms to demonstrate real-world revenue impact.

What is a price-based TOCTOU vulnerability in payment systems?▼

A price-based TOCTOU vulnerability occurs when an archived price is trusted during checkout without server-side validation, allowing attackers to exploit timing differences between adding items and finalizing the transaction to alter the final price.

How do I safely reproduce coupon race conditions for bug bounty reports?▼

Safely reproduce coupon race conditions by applying an end-to-end hunting methodology that tests discount application workflows responsibly, quantifies impact through real-world case references, and prioritizes remediation guidance for disclosure.

Can this business logic testing approach detect negative-quantity price manipulation?▼

Yes, this approach detects negative-quantity price manipulation by applying end-to-end testing to price calculations and checkout flows across SaaS and ecommerce platforms to identify decimal overflow and fraction price-field issues.

Does business logic vulnerability hunting require server-side validation testing?▼

Yes, business logic vulnerability hunting requires testing server-side validation of pricing to verify if checkout flows robustly check price calculations, discount applications, and refund paths against client-side price trust and tampering.

What are the limitations of testing business logic flaws in SaaS platforms?▼

Testing business logic flaws requires careful consideration of responsible disclosure and risk assessment limitations, as reproducing chains like coupon races or price tampering must be done safely to avoid causing actual revenue loss or unauthorized behavior.