testing-ecommerce-and-payment-logic

Intercept add-to-cart and checkout requests with Burp Suite and lower client-supplied price or amount fields, then check whether the order total and gateway charge honor the tampered value instead of the catalog price. Also test the gateway hand-off separately, since the app and gateway amounts can disagree.

Test voucher reuse after order completion, stacking via parameter pollution like code=X&code=X, brute-forcing short or sequential codes with ffuf, and tampering discount value or percent fields directly. For gift cards, attempt concurrent redemption to double-spend the balance.

A negative quantity attack sets quantity to a negative value like -3, causing buggy total calculations to subtract from the grand total and produce credits or free goods. Also test very large quantities for integer overflow and fractional values the backend may mishandle.

Yes, payment testing must use gateway sandbox or test modes with test card numbers such as 4111 1111 1111 1111, ensuring no real charges occur. Written authorization and confirmation that the environment is non-production are required prerequisites.

Check whether the payment success callback verifies its signature server-side by replaying or forging a callback with status=success on an unpaid order. If the order is marked paid without verification, attackers can fulfill orders without genuine payment.

Cart, address, and order IDOR lets one user read or modify another user's shopping objects via predictable IDs, exposing PII and enabling shipment redirection. Test with two accounts and check whether address fields also allow stored XSS that fires in admin dashboards.