hunt-business-logic

Business logic vulnerabilities are flaws in the rules governing pricing, discounts, and refunds. They create financial impact when exploited through TOCTOU scenarios, allowing attackers to bypass verification or tamper with prices during checkout workflows.

A TOCTOU race condition is a time-of-check to time-of-use flaw that affects e-commerce pricing by allowing verification bypasses during concurrent checkout requests. This Skill helps detect these timing vulnerabilities and links them to tangible financial losses.

You create a reproducible proof of concept for a price tampering bug by following an end-to-end validation framework from threat modeling to evidence collection. This Skill ensures your PoC includes clear trigger steps and guardrails suitable for disclosure reports.

Yes, this business logic testing method works for SaaS subscription workflows. It applies discovery patterns for price-tampering and verification bypasses across checkout, subscription, and admin workflows specifically in e-commerce platforms and SaaS applications.

Testing business logic flaws requires manual threat modeling and step-by-step hunting methodology rather than automated scanning. Limitations include the need to understand specific pricing rules and construct reproducible end-to-end scenarios to prove financial impact.