Payment Gateways
Vulnerabilities in purchase, subscription and transaction flows
Quick answer
What is Payment Gateways?
Payment gateways are high-impact targets. Bugs here involve price manipulation, race conditions in transactions, CSRF on cancellations and bypassing payment checks.
Severity
Critical
Frequency
Common
Payloads
8
Steps
6
Severity
Critical
Frequency
Common
Payloads
8
Payment flows are complex: cart → checkout → processing → confirmation. Every step can have client-side validations that aren't enforced on the server. Race conditions are especially common in transfers and coupon application.
Where to look
Cart and checkout
Price, quantity and currency parameters in the purchase request. Are they validated server-side?
Discount codes
Applying coupons is a classic race condition target: send multiple simultaneous requests.
Money transfers
Send two simultaneous transfers with the same balance → possible double-spending.
Subscriptions
Cancellation without a CSRF token, downgrade/upgrade without re-validating payment, trial abuse.
Invoice generation
If invoices are generated as PDF from HTML, there may be SSRF (see the HTML to PDF context).
Methodology
Analyze the full flow
Map: selection → cart → checkout → payment → confirmation. Intercept every request.
Manipulate price/quantity
Change price=1000 to price=1, quantity=1 to quantity=-1, currency=USD to currency=ARS.
Test race conditions
Coupons: send 50 requests applying the same coupon simultaneously. Transfers: two at once with the same balance.
CSRF on operations
Does subscription cancellation have a CSRF token? Does the plan change? Does removing a payment method?
Add items post-checkout
Start payment with 1 item. While it processes, add more items to the cart. Are they charged at the original price?
Check webhooks
Does the app verify the Stripe/PayPal webhook signature? If not, you can forge payment confirmations.
Real-world case
Race condition in a discount coupon → free purchases
Identify the coupon endpoint
POST /api/cart/apply-coupon with body {code: 'SAVE50'}. Applies a 50% discount.
Send simultaneous requests
Turbo Intruder with 50 identical requests in parallel. The coupon applies 3 times before being marked as used.
Result
50% + 50% + 50% = -50% of the price. The system allows a negative price → free purchase + credit.
Lesson: Coupon operations must be atomic. Without DB transactions or locks, race conditions are inevitable. Always test coupons with concurrent requests.
Payloads
Negative price
POST /api/checkout {"price": -100, "quantity": 1}Negative quantity
POST /api/cart/add {"productId": "123", "quantity": -5}Currency switch
POST /api/checkout {"currency": "CLP"} (1 USD = 900 CLP)Coupon race
seq 50 | xargs -P 50 curl -X POST .../apply-coupon -d 'code=SAVE50'
Advanced payloads(account required)
Double-spending race
Enviar 2 transferencias simultáneas: {to: B, amount: 100} + {to: C, amount: 100} (saldo=100)CSRF cancellation
<img src="https://target.com/api/subscription/cancel">
Webhook forgery
POST /webhooks/stripe {"type":"checkout.session.completed","data":{"object":{"paid":true}}}Items post-checkout
Iniciar pago → mientras carga → POST /api/cart/add → items extra no cobrados
Exclusive content
Create your free account to access advanced payloads, scripts and bypass techniques
Create free accountTools
Turbo Intruder
Send 50+ simultaneous requests to exploit race conditions in payments.
Burp → Turbo Intruder → race.py template → gate='race'
Burp Repeater Group Send
A quick alternative to Turbo Intruder for simple race conditions.
Seleccionar múltiples tabs → Click derecho → Send group (parallel)
Tips
Coupons are target #1
Send the same coupon 50 times in parallel. If it applies more than once, it's a race condition.
Test negative prices
Change the price to negative in the request. Many backends don't validate that it's positive.
Unsigned webhook = forgeable
If the app doesn't verify the Stripe webhook signature, you can forge payment confirmations.
Watch the cart during payment
If you can add items while the payment processes, the app may charge less than it delivers.
hunters training
labs from real hacks
completions
paid out for these bugs
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Practice Payment Gateways with real labs
Apply these techniques in safe environments based on real bug bounty reports.