payment-security

Payment Security Testing

Payment systems are the highest-impact attack surface in any e-commerce application. A single vulnerability translates directly to financial loss, regulatory exposure, and reputational damage. Payment findings are almost always HIGH or CRITICAL severity -- a confirmed price manipulation or payment bypass is an automatic CRITICAL.

This skill covers the full offensive lifecycle against payment systems: flow mapping, price manipulation, race conditions, IDOR exploitation, gateway bypass, cart tampering, and refund abuse.

Triage Workflow

Follow this sequence. Each phase builds on the previous one. Skip nothing -- payment logic bugs hide in edge cases.

Phase 1 -- Payment Flow Mapping

Before attacking, map the entire payment lifecycle. Every request from cart to confirmation is in scope.

Map these flows:

1. Add to cart -- item selection, quantity, variant, pricing source
2. Cart management -- update quantity, remove items, apply coupons/discounts
3. Checkout initiation -- address entry, shipping method selection, tax calculation
4. Payment method selection -- card entry, saved card, wallet, gateway redirect
5. Payment processing -- tokenization, charge creation, 3DS challenge
6. Payment confirmation -- callback/webhook, order status update, fulfillment trigger
7. Post-payment -- refund flow, cancellation, subscription management

Capture with HTTP Repeater:

Load: ToolSearch -> select:mcp__hexstrike-ai__http_repeater

Intercept the full checkout flow from cart to confirmation.
For each request, note:
- Which parameters control price, quantity, item identity
- Which parameters reference user identity (user_id, session, account)
- Where the server trusts client-supplied values vs. server-side lookup
- Where the flow can be short-circuited (skip steps, replay confirmations)

Key questions to answer during mapping:

• Does the server recalculate totals, or trust the client-submitted amount?
• Are item prices embedded in the request, or looked up by product ID?
• Is the payment amount derived from the cart at checkout time, or passed as a parameter?
• Does the webhook/callback validate the payment amount matches the order total?
• Can checkout steps be reordered or skipped?