Hunt Business Logic
Hunting skill for business logic vulnerabilities.
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-business-logic -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Security
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic, heavy emphasis on financial-impact-demonstrated cases.
Crown Jewel Targets
Business logic vulnerabilities pay highest in platforms where financial transactions, identity verification, and access controls intersect with real-world consequences. The richest targets are:
- E-commerce & payment platforms (Valve/Steam, Shopify), payment flow manipulation, free goods, price tampering
- Marketplace & gig economy apps (Airbnb, Uber), identity/verification bypass enabling fraud or unsafe interactions
- SaaS with tiered access (Mozilla Monitor), bypassing verification to unlock monitoring features without entitlement
- High-traffic consumer apps (Snapchat, Yelp), rate-limit bypass enabling spam, enumeration, or abuse at scale
Asset types that pay: checkout flows, subscription endpoints, callback/verification systems, webhook handlers, employee/internal portals exposed to the internet, and any endpoint that trusts client-supplied data to make authorization decisions.
Attack Surface Signals
URL patterns to watch:
/checkout,/order,/subscribe,/payment,/verify,/confirm,/callback/internal,/employee,/summit,/staff,/admin, internal pages accidentally public/api/v*/payment,/api/v*/notify,/webhook, payment provider callbacks- Endpoints accepting
X-Forwarded-For,X-Real-IP,CF-Connecting-IPheaders
Response/header signals:
Set-Cookiewith unvalidated session state tied to cart or order data- Payment provider names in responses:
Smart2Pay,Stripe,PayPal,Braintree - Redirect chains through third-party payment pages (in-flight data opportunity)
200 OKon subscription/verification endpoints with no CAPTCHA or token
