skills.rest
pdparchitect
pdparchitectCOMMUNITY
Explore all skills by this author →
Website𝕏@pdpGitHub

hunt-business-logic

Identify and validate business logic vulnerabilities in web applications.

13|2|Updated Jun 1, 2026
Search Tags:#payment security#security audit#api testing#business logic#vulnerability research#bug bounty
One-click install
npx skills add https://github.com/pdparchitect/rook --skill hunt-business-logic-pdparchitect
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-business-logic
Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-business-logic
Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-business-logic-pdparchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying complex business logic vulnerabilities, such as price tampering, rate-limit bypasses, and unauthorized access, which automated scanners often miss.

Core Features & Use Cases

  • Vulnerability Hunting: Provides a structured methodology for testing payment flows, authentication boundaries, and rate-limiting controls.
  • Payload Generation: Includes specific patterns for testing price manipulation, header-based rate-limit bypasses, and internal surface discovery.
  • Use Case: Use this skill to audit a checkout flow for price tampering or to verify if an application correctly validates payment webhooks against HMAC signatures.

Quick Start

Use the hunt-business-logic skill to audit the checkout endpoint on the target domain for price tampering and rate-limit bypass vulnerabilities.

Frequently Asked Questions about hunt-business-logic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for business logic vulnerabilities in payment flows?▼

To test for business logic vulnerabilities, systematically audit checkout endpoints for price tampering, rate-limit bypasses, and unauthorized access by manipulating client-side trust and verifying server-side validation.

What is a business logic vulnerability in web applications?▼

A business logic vulnerability is a flaw in application design where attackers exploit price tampering, rate-limit bypasses, or unauthorized access to manipulate financial flows and bypass authentication boundaries.

How do I bypass rate-limits using HTTP headers during API testing?▼

To bypass rate-limits during API testing, generate and inject specific header-based payload patterns to manipulate server-side validation controls and evaluate state-machine integrity.

How do I verify HMAC signatures for payment webhooks?▼

To verify HMAC signatures for payment webhooks, audit authentication boundaries to confirm the application correctly validates webhook payloads against server-side security controls.

Can automated scanners find price tampering vulnerabilities?▼

Automated scanners often miss complex price tampering vulnerabilities because they require systematic testing of client-side trust, state-machine integrity, and specific payload generation.

When should I perform a security audit for state-machine integrity?▼

Perform a security audit for state-machine integrity when targeting internal API endpoints and authentication boundaries to demonstrate financial or security impact from unauthorized access.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
chatbotkitchatbotkit
13

hunt-business-logic

Identify and analyze business-logic flaws in web applications for bug-bounty reports.

Official
Advanced
giosuetedeschi-specgiosuetedeschi-spec

Cross-Site Scripting and HTML Injection Testing

Detect and exploit XSS and HTML injection vulnerabilities in web applications.

Community
Advanced
langbyyilangbyyi
96

business-logic-vulnerabilities

Identifies high-severity business logic vulnerabilities in web applications.

Community
Advanced