skills.rest
grivera82
grivera82COMMUNITY
Explore all skills by this author →
GitHub

hunt-business-logic

Identify and document business-logic vulnerabilities in web applications.

Updated May 31, 2026
Search Tags:#vulnerability#business-logic#web-application#security-research#bug-bounty#hunt
One-click install
npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-business-logic-grivera82
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-business-logic
Source: https://github.com/grivera82/pi-bughunter/tree/main/skills/hunt-business-logic
Command: npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-business-logic-grivera82

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Business logic vulnerabilities in web applications often enable attackers to manipulate prices, discounts, or access control, leading to financial loss and unauthorized actions. This skill helps identify and understand such flaws by mapping real-world patterns and attack surfaces across checkout, pricing, and verification flows.

Core Features & Use Cases

  • Pattern-based detection of race conditions, price tampering, and authorization bypass in business logic layers.
  • Evidence-driven hunting using public bug-bounty reports to prioritize high-risk targets.
  • Use Case: Assess e-commerce platforms or SaaS offerings where client-supplied data governs pricing or entitlement decisions.

Quick Start

Follow the methodology to map authentication boundaries, enumerate verification steps, and test rate-limiting and webhook signals in authorized engagements.

Frequently Asked Questions about hunt-business-logic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What are business-logic vulnerabilities in web applications?▼

Identify business-logic vulnerabilities by mapping authentication boundaries, enumerating verification steps, and testing rate-limiting and webhook signals across checkout and pricing flows in authorized engagements.

How do I test for race conditions in checkout and pricing flows?▼

Yes, you can use this methodology for e-commerce and SaaS security research, specifically when client-supplied data governs pricing or entitlement decisions and creates financial risk.

What is the best way to document authorization bypass findings for bug bounties?▼

This methodology prioritizes evidence-driven hunting using public bug-bounty reports to target high-risk areas like race conditions, price tampering, and authorization bypass in business logic layers.

How do I safely test price tampering vulnerabilities without impacting production revenue?▼

Limitations include the requirement to only execute tests in authorized engagements, as the methodology outputs reproducible payloads and evidence that must be auditable and safe.

Related Skills

Explore More Software Engineering Skills→
pikakitpikakit

Defense-in-Depth Validation

Implement multi-layer data validation across input, business logic, environment, and debugging.

Community
Advanced
davpatel605-beepdavpatel605-beep

web-pentest

Perform authorized web application penetration testing with structured vulnerability classification and reporting.

Community
Advanced
cybersecwomancybersecwoman
5

bb-local-toolkit

Coordinate bug bounty workflows from reconnaissance through reporting.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced