hunt-business-logic

> **⚠️ AUTHORIZED USE ONLY**

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Crown Jewel Targets

Business logic vulnerabilities pay highest in platforms where financial transactions, identity verification, and access controls intersect with real-world consequences. The richest targets are:

- **E-commerce & payment platforms** (Valve/Steam, Shopify) — payment flow manipulation, free goods, price tampering

- **Marketplace & gig economy apps** (Airbnb, Uber) — identity/verification bypass enabling fraud or unsafe interactions

- **SaaS with tiered access** (Mozilla Monitor) — bypassing verification to unlock monitoring features without entitlement

- **High-traffic consumer apps** (Snapchat, Yelp) — rate-limit bypass enabling spam, enumeration, or abuse at scale

Asset types that pay: checkout flows, subscription endpoints, callback/verification systems, webhook handlers, employee/internal portals exposed to the internet, and any endpoint that trusts client-supplied data to make authorization decisions.

---

Attack Surface Signals

**URL patterns to watch:**

- `/checkout`, `/order`, `/subscribe`, `/payment`, `/verify`, `/confirm`, `/callback`

- `/internal`, `/employee`, `/summit`, `/staff`, `/admin` — internal pages accidentally public

- `/api/v*/payment`, `/api/v*/notify`, `/webhook` — payment provider callbacks

- Endpoints accepting `X-Forwarded-For`, `X-Real-IP`, `CF-Connecting-IP` headers

**Response/header signals:**

- `Set-Cookie` with unvalidated session state tied to cart or order data

- Payment provider names in responses: `Smart2Pay`, `Stripe`, `PayPal`, `Braintree`

- Redirect chains through third-party payment pages (in-flight data opportunity)

- `200 OK` on subscription/verification endpoints with no CAPTCHA or token

**JS patterns:**

- Hardcoded internal URLs in frontend bundles (`/employee/`, `/staff/`, `/internal/`)

- Client-side price calculation before server submission

- Verification logic that only checks on the frontend (`if (verified) { ... }`)

- `fetch('/api/subscribe', { method: 'POST', body: ... })` with no anti-CSRF token or rate-limit token

**Tech stack signals:**

- Shopify storefronts with draft/unpublished channel pages

- Apps using IP-based rate limiting without session/account binding

- Payment webhooks with no HMAC signature validation

- SMS/phone callback flows that don't verify ownership before enabling features

---

Step-by-Step Hunting Methodology

1. **Map all authentication boundaries.** Spider the target. Identify pages/endpoints that serve authenticated content (employee portals, premium features, order pages) and test each unauthenticated. Look for internal pages indexed in JS bundles or linked from robots.txt/sitemap.xml.

2. **Identify every verification flow.** Enumerate: email verification, phone/SMS verification, payment verification, CAPTCHA, age gates. For each, test: what happens if you skip the verification step entirely? What happens if you replay a valid token on a different account?

3. **Test rate-limiting controls on every form.** For every POST endpoint (subscribe, login, OTP, search), send 50+ rapid requests. Vary: remove cookies, rotate `X-Forwarded-For` / `X-Real-IP` headers, change `User-Agent`.