business-logic-vuln

Original：🇨🇳 Chinese

Translated

Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.

1installs

Sourceyaklang/hack-skills

Added on2026-04-09

NPX Install

npx skill4agent add yaklang/hack-skills business-logic-vuln

SKILL.md Content (Chinese)

View Translation Comparison →

Business Logic Router

This is the entry category for business logic and state machine issues.

When to Use

Targets involve coupons, inventory, payment, approval, quota, invitation, trial or state flow
The problem is not with the parser, but lies in "when to check" and "what business conditions are checked"
You suspect race conditions, process bypass, price tampering, negative values, stacked discounts or multi-step defects

Skill Map

Business Logic Vulnerabilities

Recommended Flow

First draw key business states and one-time actions
Then determine whether there is a check-then-act window, sequence dependency or lack of cross-step authorization
If the business link relies on API, upload or object permissions, return to the corresponding category skill to supplement the link

Related Categories

api-sec
auth-sec
file-access-vuln