In-depth penetration testing for e-commerce stores that quietly lose money to checkout fraud.

E-commerce penetration testing isn't about an attacker taking the site down. It's about hundreds of orders a month going out with modified prices, reused coupons, fraudulent free shipping and duplicate refunds. You won't see it in the application logs — you'll see it in reconciliation with your acquirer, three months later, when the books don't balance.

The most common patterns:

• Price manipulation — the attacker changes the amount between cart and payment, and the gateway accepts it
• Coupon reuse — a “single-use” campaign code that works 5 times
• Card testing — the checkout becomes a validator for stolen cards at scale
• Free-shipping fraud — bypassed by modifying the ZIP/postal code or region
• Cashback on cancellations — the customer cancels and keeps the cashback

Here, a pentest pays for itself in the first month — fraud documented and shut down.

Checkout and purchase flow

• Price manipulation between cart, checkout and payment
• Order BOPLA (changing amount, status or shipping via a direct PATCH)
• Inventory race conditions (buying out-of-stock products)
• Order race conditions (creating 2 orders with 1 validated card)
• Tax ID (e.g., Brazil's CPF) / personal data validation bypass
• Currency manipulation in multi-currency stores
• Bypass of combo / product bundle rules

Coupons, vouchers and cashback

• Reuse of single-use coupons (race condition)
• Combining mutually exclusive coupons
• Eligibility rule bypass (tax ID, first order, minimum order value)
• Discount percentage manipulation via payload
• Fraudulent cashback on cancellations
• Loyalty program cashback stacking

Shipping and delivery

• Shipping cost manipulation (changing the amount after the order is placed)
• ZIP/postal code or region validation bypass for free shipping
• Bypass of rules for products that don't ship to a region
• BOLA on order tracking (accessing another customer's delivery)
• Delivery status manipulation
• SSRF via the carrier integration

Bot defenses, anti-fraud and card testing

• Card testing — approval rate as a signal for the attacker
• Checkout rate limiting by IP / device / BIN / ZIP code
• CAPTCHA bypass (token reuse, headless detection)
• Fingerprint forgery (User-Agent, Accept-Language, screen)
• Abuse of sign-up/login flows to evade anti-fraud controls
• Risk score bypass through payload modification
• Mastercard SDP / Visa CPP — high-risk merchant compliance

Catalog and search

• Product BOPLA (changing another seller's price on a marketplace)
• Mass assignment on product updates
• SQL injection / NoSQL injection in search
• SSRF via product import from a URL
• Stored XSS in product descriptions
• Path traversal in image uploads

Customer accounts

• BOLA on orders, addresses and saved cards
• Account takeover (ATO) via OAuth (Google, Apple, Facebook login)
• Recovery tokens — entropy, replay, expiration
• BOLA on wishlists
• PII leakage on public endpoints

Acquirer and ERP integrations

• Webhook tampering — replay, signature bypass
• Reconciliation race conditions (an order marked as paid without payment)
• SSRF via ERP integrations (Bling, Tiny, Linx)
• Sub-acquirer payload manipulation
• 3DS validation bypass

Platform-specific

• VTEX IO — custom apps, Master Data, Checkout UI customization
• Shopify — Shopify apps, Liquid templates, Storefront API
• Magento 2 — extensions, ACL, customer data leaks
• Tray, Loja Integrada, Nuvemshop, custom platforms

Every engagement gets a custom quote once the scope is defined. The hourly rate ranges from US$ 150 to US$ 250 depending on stack, testing mode and timeline — larger packages have a lower hourly rate. Invoiced in USD via Wise or international wire transfer: 50% at kickoff, 50% on delivery.