skills.rest
jellaharshith
jellaharshithCOMMUNITY
Explore all skills by this author →
GitHub

hunt-business-logic

Identify business logic vulnerabilities in web payment and verification flows.

1|Updated Apr 18, 2026
Search Tags:#rate limiting#business logic#webhook validation#payment tampering#verification bypass#attack methodology
One-click install
npx skills add https://github.com/jellaharshith/SWIFT --skill hunt-business-logic-jellaharshith
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-business-logic
Source: https://github.com/jellaharshith/SWIFT/tree/main/swift/skills/cbh/skills/hunt-business-logic
Command: npx skills add https://github.com/jellaharshith/SWIFT --skill hunt-business-logic-jellaharshith

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you uncover business logic vulnerabilities in web applications where attackers can manipulate verification, rate limits, or payment/state transitions to create real financial, privacy, or access impact.

Core Features & Use Cases

  • Guided hunting for business logic weaknesses across authentication boundaries, verification gates, and transactional flows.
  • Targeted checks for common root causes like client-trusted amounts, spoofable rate limiting headers, missing webhook signature validation, and unprotected internal/employee surfaces.
  • Reproducible methodology that emphasizes proof of what an attacker can do, what the victim loses, and whether the impact is achievable quickly from scratch.

Quick Start

Use hunt-business-logic to plan and run a business-logic vulnerability hunt against your target by mapping authentication boundaries, identifying verification and callback flows, and testing for step-skip, header-spoofed rate limit bypass, and payment/webhook validation failures.

Frequently Asked Questions about hunt-business-logic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find business logic vulnerabilities in web applications?▼

This skill finds business logic vulnerabilities by testing server-side enforcement across checkout, subscription verification, and third-party payment webhooks to ensure attackers cannot bypass verification or manipulate transactional flows.

How do I test for payment tampering and webhook validation failures?▼

Test for payment tampering by verifying whether callback endpoints validate webhook signatures and enforce server-side amount checks, preventing attackers from spoofing client-trusted amounts or skipping verification steps.

Can I use this to bypass rate limiting with spoofed headers?▼

Yes, you can test rate limiting bypass assumptions by spoofing rate-limit headers, but the methodology requires validating server-side enforcement rather than trusting client-side header values alone.

What is needed to reproduce business logic flaws during a vulnerability hunt?▼

Reproducing business logic flaws requires a methodology that proves what an attacker can do, what the victim loses, and whether the impact is achievable quickly from scratch within a tight reproducibility window.

Does this methodology work for testing phone and callback trust flows?▼

Yes, it applies to web targets involving phone/callback trust by testing whether attackers can bypass verification gates or access unintended internal functionality through those flows.

Related Skills

Explore More Software Engineering Skills→
yaklangyaklang
1.6k

auth-sec

Map authentication and authorization test scope for web and API targets.

Official
Intermediate
harperaaharperaa
15

business-logic-flaws-ai-generated-code

Detect race conditions and business-logic vulnerabilities in AI-generated code.

Community
Intermediate
krzemienskikrzemienski
2

api-validation

Validate API endpoints and capture HTTP responses and JSON bodies for evidence.

Community
Intermediate
langbyyilangbyyi
96

business-logic-vulnerabilities

Identifies high-severity business logic vulnerabilities in web applications.

Community
Advanced