business-logic-vuln
yaklang/hack-skills
Router for business logic vulnerabilities including race conditions, workflow abuse, and state-machine flaws.
What is business-logic-vuln?
Entry point for identifying business logic and state-machine issues where workflow abuse, race conditions, pricing flaws, or multi-step state attacks are the primary concern. Use this when the vulnerability is about when checks happen and which business conditions are enforced, rather than parser-level input injection.
- Routes to business logic vulnerability testing based on attack surface
- Identifies check-then-act windows and sequence dependencies
- Detects workflow bypass, price tampering, and stacked discount flaws
- Maps key business states and one-time actions
- Checks for missing cross-step authorization and race conditions
How to install business-logic-vuln
npx skills add https://github.com/yaklang/hack-skills --skill business-logic-vulnHow to use business-logic-vuln
- 1.Map key business states and identify one-time actions in the target system
- 2.Check for check-then-act windows and sequence dependencies between steps
- 3.Look for missing cross-step authorization or validation gaps
- 4.If the chain depends on APIs, uploads, or object permissions, use the corresponding router skill (api-sec, auth-sec, or file-access-vuln)
- 5.Test for race conditions, workflow bypass, price tampering, and stacked discounts
Use cases
- Testing coupon stacking or discount combination exploits
- Detecting race conditions in inventory or payment processing
- Identifying workflow bypass in approval or invitation systems
- Finding pricing manipulation through negative values or state transitions
- Testing quota or trial period abuse across multiple steps
- Security researchers testing e-commerce platforms
- API security testers focused on business logic
- QA engineers validating state machine implementations
- Penetration testers examining multi-step workflows
business-logic-vuln FAQ
Use this skill when the vulnerability is about business logic, state transitions, and when checks happen—not about parser-level input injection or encoding bypasses.
Map the business logic flow first, then return to the api-sec router skill to complete the testing path for API-specific vulnerabilities.
Look for gaps between when a condition is checked and when an action is executed; race conditions often exploit these windows in concurrent requests.
Focus on actions like coupon redemption, trial activation, invitation acceptance, and payment processing that should only succeed once.
Full instructions (SKILL.md)
Source of truth, from yaklang/hack-skills.
name: business-logic-vuln description: >- Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.
Business Logic Router
This is the routing entry point for business-logic and state-machine issues.
When to Use
- The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions
- The issue is not parser-level; it is about when checks happen and which business conditions are checked
- You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws
Skill Map
- Business Logic Vulnerabilities
Recommended Flow
- First map key business states and one-time actions
- Then check for check-then-act windows, sequence dependencies, or missing cross-step authorization
- If the chain depends on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path
Related Categories
- api-sec
- auth-sec
- file-access-vuln
Related skills
More from yaklang/hack-skills and the wider catalog.
business-logic-vulnerabilities
Identify business logic flaws: race conditions, price manipulation, workflow bypasses, and state machine attacks invisible to scanners.
classical-cipher-analysis
Identify and break classical ciphers using frequency analysis, Kasiski examination, and cryptanalysis techniques.
clickjacking
Test and exploit clickjacking vulnerabilities by framing target pages and bypassing frame-busting protections.
cmdi-command-injection
Expert command injection attack playbook for shell metacharacters, blind detection, and OOB exfiltration.
code-obfuscation-deobfuscation
Identify and defeat code obfuscation: junk code, opaque predicates, SMC, control flow flattening, VM protectors, and string encryption.
container-escape-techniques
Expert container escape techniques for Docker, Kubernetes, and LXC breakout via privileged mode, capabilities, and runtime vulnerabilities.