Agent skill · security · yaklang
business-logic-vulnerabilities
Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.
Why this skill is useful
Provides a comprehensive playbook with specific exploitation techniques and methodologies for identifying and exploiting business logic vulnerabilities that the AI cannot infer from general knowledge.
What it needs
About 11k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Business Logic Vulnerabilities — Expert Attack Playbook AI LOAD INSTRUCTION: Business logic flaws are scanner-invisible and high-reward on bug bounty. This skill covers race conditions, price manipulation, workflow bypass, coupon/referral abuse, negative values, and state machine attacks. These require human reasoning, not automation. For specific exploitation techniques (payment precision/overflow, captcha bypass, password reset flaws, user enumeration), load the companion SCENARIOS.md. For the workflow approach itself (modeling → state machine → attack-surface matrix → human judgement) load METHODOLOGY.md. For the per-module check items load CHECKLIST.md. Companion files File When to load --- --- METHODOLOGY.md Need the 5-phase workflow, attack-surface 5×N matrix, human-judgement decision tree CHECKLIST.md Going through a target module-by-module (login / register / payment / IDOR / privacy) and want every line item with why+verify SCENARIOS.md Drilling deeper into payment precision/overflow, captcha bypass, password reset, enumeration, frontend bypass Extended Scenarios Also load SCENARIOS.md when you need: Payment precision & integer overflow attacks — 32-bit overflow to negative, decimal rounding exploitation, negative shipping fees Payment parameter tampering checklist — price, discount, currency, gateway, returnurl fields Condition race practical patterns — parallel coupon application, gift card double-spend with Burp group send Captcha bypass techniques — drop verification request, remove parameter, clear cookies to reset counter, OCR with tesseract Arbitrary password reset — predictable tokens (md5(username)), session replacement attack, registration overwrite User information enumeration — login error message difference, masked data reconstruction across endpoints, base64 uid cookie manipulation Frontend restriction bypass — array parameters for multiple coupons (couponid[0]/couponid[1]), remove disabled/readonly attributes Application-layer DoS patt …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/business-logic-vulnerabilities