Burp-Suite Payment Flow Audit -- 2

I run the e-commerce site you will be testing, so you can proceed knowing full authorisation is in place. My top priority is the UPI payment verification path: today, staff still confirm transactions manually in our admin panel, which leaves room for timing and logic attacks. I want a seasoned Burp Suite Professional to dissect that flow end-to-end, prove or disprove bypass scenarios, and document every weakness that surfaces.

Scope
• Intercept and manipulate the UPI checkout, callback (or lack thereof), and payment-status update mechanisms.
• Probe related APIs for injection points, broken authentication, or order/price manipulation avenues.
• Stress-test JWT handling, session tokens, and any API endpoints that could influence payment states.
• Map findings against OWASP Top 10 and produce clear, reproducible PoCs.

Deliverables
1. Penetration-test report highlighting each vulnerability, risk rating, and business impact.
2. Step-by-step exploitation proofs (Burp Suite project files or screen recordings are welcome).
3. Actionable remediation guidance that aligns with PCI DSS best practices.

This is a focused engagement: once the UPI flow is covered, we can expand to other modules if both sides are confident in the results.