Business Logic Errors · passage 4 of 11

Discount Code Feature Testing

Text · Business Logic Errors/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

* Try to apply the same discount code multiple times to assess if it's reusable. * If the discount code is unique, evaluate for race conditions by applying the same code for two accounts simultaneously. * Test for Mass Assignment or HTTP Parameter Pollution to see if you can apply multiple discount codes when the application is designed to accept only one. * Test for vulnerabilities from missing input sanitization such as XSS, SQL Injection on this feature. * Attempt to apply discount codes to non-discounted items by manipulating the server-side request.

Every one of the 11 is a mark on the map. Named now: 1 to 11, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.