Business Logic Vulnerabilities
Install this when you need a human-reasoning playbook to hunt business-logic flaws—races, pricing abuse, workflow bypass—that scanners miss before ship or bounty review.
Overview
business-logic-vulnerabilities is an agent skill for the Ship phase that provides a business-logic attack playbook with methodology, checklists, and scenarios for race, pricing, and workflow flaws.
Install
npx skills add https://github.com/yaklang/hack-skills --skill business-logic-vulnerabilitiesWhat is this skill?
- Expert playbook for scanner-invisible business logic flaws on bug bounty targets
- Companion METHODOLOGY.md: 5-phase workflow with attack-surface matrix and human-judgement tree
- Companion CHECKLIST.md: per-module line items for login, register, payment, IDOR, and privacy
- Companion SCENARIOS.md for payment precision, captcha bypass, password reset, and enumeration
- Coverage includes race conditions, coupon abuse, state machines, and multi-step authorization gaps
- 5-phase methodology workflow in METHODOLOGY.md
- Per-module CHECKLIST covering login, register, payment, IDOR, and privacy
- Attack-surface 5×N matrix referenced in methodology companion
Adoption & trust: 1.1k installs on skills.sh; 980 GitHub stars; 1/3 security scanners passed (skills.sh audits).
What problem does it solve?
Automated scanners pass while checkout, coupons, and multi-step auth still break under realistic abuse sequences you have not modeled.
Who is it for?
Intermediate-to-advanced builders and bounty hunters reviewing SaaS, ecommerce, or API workflows where state and money matter.
Skip if: Beginners seeking a one-click scanner replacement or teams that only need dependency CVE triage without application logic review.
When should I use this skill?
Reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps on a target you are authorized to assess.
What do I get? / Deliverables
You work through a structured methodology, module checklist, and scenario deep-dives so prioritized logic-attack hypotheses are ready for manual verification.
- Attack-surface matrix and logic-flaw hypotheses
- Module checklist pass/fail notes
- Scenario-specific exploitation notes from SCENARIOS.md
Recommended Skills
Journey fit
How it compares
Human-judgement security playbook with companion checklists—not a generic OWASP Top 10 linter or infrastructure hardening skill.
Common Questions / FAQ
Who is business-logic-vulnerabilities for?
It is for security-minded solo builders, indie SaaS founders, and bug bounty researchers who need structured logic-flaw reasoning on real workflows.
When should I use business-logic-vulnerabilities?
Use it in Ship during security review before release, when auditing payments or coupons, or when mapping state machines for auth and checkout flows.
Is business-logic-vulnerabilities safe to install?
The skill is educational offensive-security guidance; only use on systems you are authorized to test and review the Security Audits panel on this Prism page for the package.
SKILL.md
READMESKILL.md - Business Logic Vulnerabilities
# SKILL: Business Logic Vulnerabilities — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Business logic flaws are scanner-invisible and high-reward on bug bounty. This skill covers race conditions, price manipulation, workflow bypass, coupon/referral abuse, negative values, and state machine attacks. These require human reasoning, not automation. For specific exploitation techniques (payment precision/overflow, captcha bypass, password reset flaws, user enumeration), load the companion [SCENARIOS.md](./SCENARIOS.md). For the workflow approach itself (modeling → state machine → attack-surface matrix → human judgement) load [METHODOLOGY.md](./METHODOLOGY.md). For the per-module check items load [CHECKLIST.md](./CHECKLIST.md). ### Companion files | File | When to load | |---|---| | [METHODOLOGY.md](./METHODOLOGY.md) | Need the 5-phase workflow, attack-surface 5×N matrix, human-judgement decision tree | | [CHECKLIST.md](./CHECKLIST.md) | Going through a target module-by-module (login / register / payment / IDOR / privacy) and want every line item with why+verify | | [SCENARIOS.md](./SCENARIOS.md) | Drilling deeper into payment precision/overflow, captcha bypass, password reset, enumeration, frontend bypass | ### Extended Scenarios Also load [SCENARIOS.md](./SCENARIOS.md) when you need: - Payment precision & integer overflow attacks — 32-bit overflow to negative, decimal rounding exploitation, negative shipping fees - Payment parameter tampering checklist — price, discount, currency, gateway, return_url fields - Condition race practical patterns — parallel coupon application, gift card double-spend with Burp group send - Captcha bypass techniques — drop verification request, remove parameter, clear cookies to reset counter, OCR with tesseract - Arbitrary password reset — predictable tokens (`md5(username)`), session replacement attack, registration overwrite - User information enumeration — login error message difference, masked data reconstruction across endpoints, base64 uid cookie manipulation - Frontend restriction bypass — array parameters for multiple coupons (`couponid[0]`/`couponid[1]`), remove `disabled`/`readonly` attributes - Application-layer DoS patterns — regex backtracking, WebSocket abuse --- ## 1. PRICE AND VALUE MANIPULATION ### Negative Quantity / Price Many applications validate "amount > 0" but not for currency: ``` Add to cart with quantity: -1 Update quantity to: -100 { "quantity": -5, "price": -99.99 ← may be accepted } ``` **Impact**: Receive credit to account, items for free, bank transfers in reverse. ### Decimal Quantity — "0元购" Case Real instructor-led case: an e-commerce app accepted **fractional `quantity`** because backend trusted client float values: ```json // Cart item: {"id": 114016, "skuQty": 0.02} // Original price ¥500 → final price ¥10 // Variant on a food delivery app: // FoodNum=0.01 → 68元 商品 实付 0.68元 ``` Why it works: server multiplies `unit_price * quantity` without enforcing `quantity ∈ Z+`, so a 2% sliver order pays 2% price but ships the full item. Reproduce by intercepting the cart submit → setting `skuQty` / `FoodNum` to `0.02` → finishing checkout. ### Drop a Required Field — Free Tier Coercion Sport activity registration: when paid prizes are involved server returns `"payType": "paid"`; if the client request is **edited to omit `prizeIdList` entirely**, the server falls back to `"payType": "free"` and creates a successful registration that should have cost money. ```json // Original {"prizeIdList": ["6264e6948fe587000113e2d9"], ...} // Modified — array removed entirely {"prizeIdList": [], ...} // Server response: {"ok": true, "payType": "free"} ``` This is a parameter-existence trust bug — backend treats "field absent" as "n