Business Logic Errors · passage 10 of 11

Thread Comment Testing

Text · Business Logic Errors/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

* Check if there's a limit to the number of comments on a thread. * If a user can only comment once, use race conditions to see if multiple comments can be posted. * If the system allows comments by verified or privileged users, try to mimic these parameters and see if you can comment as well. * Attempt to post comments impersonating other users.

Every one of the 11 is a mark on the map. Named now: 1 to 11, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.