business-logic-vulnerabilities
business logic vulnerabilities
What it does
- Payment precision & integer overflow attacks — 32-bit overflow to negative, decimal rounding exploitation, negative shipping fees
- Payment parameter tampering checklist — price, discount, currency, gateway, returnurl fields
- Condition race practical patterns — parallel coupon application, gift card double-spend with Burp group send
- Captcha bypass techniques — drop verification request, remove parameter, clear cookies to reset counter, OCR with tesseract
- Arbitrary password reset — predictable tokens (md5(username)), session replacement attack, registration overwrite
- User information enumeration — login error message difference, masked data reconstruction across endpoints, base64 uid cookie manipulation
- Frontend restriction bypass — array parameters for multiple coupons (couponid[0]/couponid[1]), remove disabled/readonly attributes
Requirements & configuration
- | METHODOLOGY.md | Need the 5-phase workflow, attack-surface 5×N matrix, human-judgement decision tree |
- Also load SCENARIOS.md when you need:
- This is a parameter-existence trust bug — backend treats "field absent" as "no paid item to enforce", so fix is to require the field and validate its content server-side.
- Password reset token race → reuse same token twice
- 2. Receive token
Configuration: RAND_MAXMETHODOLOGYCHECKLISTSCENARIOS
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
business-logic-vulnerabilities FAQ
What does the business-logic-vulnerabilities skill do?
>- Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps. Payment precision & integer overflow attacks — 32-bit overflow to negative, decimal rounding exploitation, negative shipping fees Payment parameter tampering checklist — price, discount, currency, gateway, returnurl fields
What does business-logic-vulnerabilities require?
| METHODOLOGY.md | Need the 5-phase workflow, attack-surface 5×N matrix, human-judgement decision tree | Also load SCENARIOS.md when you need: This is a parameter-existence trust bug — backend treats "field absent" as "no paid item to enforce", so fix is to require the field and validate its content server-side. Password reset token race → reuse same token twice 2. Receive token Configuration keys: RAND_MAX, METHODOLOGY, CHECKLIST, SCENARIOS.
How do I install business-logic-vulnerabilities?
Run: npx -y skills add https://github.com/yaklang/hack-skills --skill business-logic-vulnerabilities --agent claude-code — the source lives at github.com/yaklang/hack-skills.
Maintain business-logic-vulnerabilities?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[business-logic-vulnerabilities on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-business-logic-vulnerabilities?ref=badge) npx agentictools info skills/yaklang-hack-skills-business-logic-vulnerabilities The second line is the CLI lookup for this page — handy in READMEs and docs.
Related skills
api-auth-and-jwt-abuse api auth and jwt abuse
authbypass-authentication-flaws authbypass authentication flaws
websocket-security websocket security
jwt-oauth-token-attacks jwt oauth token attacks
scanning-with-aws-security-agent Agent skill from aws/agent-toolkit-for-aws.
threat-modeling-with-aws-security-agent Agent skill from aws/agent-toolkit-for-aws.