[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71BM9ZPHJSXPF2Z4K5JTYFX":3,"skill-same:01M71BM9ZPHJSXPF2Z4K5JTYFX":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":61,"updatedAt":62,"install":63,"resources":75},"01M71BM9ZPHJSXPF2Z4K5JTYFX","cyber-testing-for-business-logic-vulnerabilities",null,"Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-testing-for-business-logic-vulnerabilities\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"testing","for","business","logic","vulnerabilities","testing for business logic vulnerabilities","cyber testing for business logic vulnerabilities","escalation","web-application-security","penetration","security","owasp","NIST","privilege escalation","apache","subdomain","vulnerability","workflow","false","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cyber-testing-for-business-logic-vulnerabilities\ndescription: \"Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: testing-for-business-logic-vulnerabilities | description: Identifying flaws in application business logic that allow price manipulation, |   workflow bypass, and privilege escalation beyond what technical vulnerability scanners |   can detect. | domain: cybersecurity | subdomain: web-application-security | tags: | - penetration-testing | - business-logic | - owasp | - web-security | - burpsuite | - manual-testing | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - PR.P\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Testing for Business Logic Vulnerabilities\n\n## When to Use\n\n- During authorized penetration tests when automated scanners have found few technical vulnerabilities\n- When assessing e-commerce platforms for pricing, cart, and payment flow manipulations\n- For testing multi-step workflows (registration, checkout, approval processes) for bypass opportunities\n- When evaluating rate-limited features like vouchers, coupons, referrals, and rewards systems\n- During security assessments of financial applications, voting systems, or any application with critical business rules\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement covering business logic testing\n- **Burp Suite Professional**: For intercepting and modifying multi-step request flows\n- **Application understanding**: Thorough knowledge of the application's intended business workflows\n- **Multiple test accounts**: Accounts at different privilege levels and states\n- **Browser DevTools**: For examining client-side validation logic\n- **Documentation**: Business requirements or user stories describing expected behavior\n\n## Workflow\n\n### Step 1: Map Business Workflows and Rules\n\nDocument all critical business processes and their expected constraints.\n\n```\n# Critical business flows to map:\n# 1. Registration\u002FOnboarding flow\n#    - Email verification requirements\n#    - Account approval process\n#    - Role assignment logic\n\n# 2. E-commerce\u002FPurchase flow\n#    - Product selection → Cart → Checkout → Payment → Confirmation\n#    - Price calculation logic\n#    - Discount\u002Fcoupon application\n#    - Quantity limits\n#    - Shipping cost calculation\n\n# 3. Authentication\u002FAuthorization flow\n#    - Login → MFA → Dashboard\n#    - Password reset → Token → New password\n#    - Role escalation\u002Fapproval\n\n# 4. Financial transactions\n#    - Balance check → Transfer → Confirmation\n#    - Withdrawal limits\n#    - Currency conversion\n\n# Document expected constraints:\n# - Minimum order amounts\n# - Maximum quantity per item\n# - Coupon usage limits (one per user)\n# - Referral reward caps\n# - Withdrawal daily limits\n# - Account verification requirements before certain actions\n```\n\n### Step 2: Test Price and Quantity Manipulation\n\nIntercept and modify price, quantity, and total values in requests.\n\n```bash\n# Test negative quantity\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": -1, \"price\": 99.99}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Test zero price\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": 1, \"price\": 0}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Test extremely large quantity\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": 999999999}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Test decimal\u002Ffloat manipulation\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": 0.001, \"price\": 0.01}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Test integer overflow\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": 2147483647}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Modify total amount directly in checkout request\n# Intercept in Burp and change total from 299.99 to 0.01\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"cart_id\": \"abc123\", \"total\": 0.01, \"payment_method\": \"card\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcheckout\"\n```\n\n### Step 3: Test Workflow Step Bypass\n\nAttempt to skip required steps in multi-step processes.\n\n```bash\n# Skip email verification\n# Instead of: Register → Verify email → Access dashboard\n# Try: Register → Access dashboard directly\ncurl -s -H \"Authorization: Bearer $UNVERIFIED_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fdashboard\"\n\n# Skip payment step\n# Instead of: Cart → Shipping → Payment → Confirmation\n# Try: Cart → Confirmation (skip payment)\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"cart_id\": \"abc123\", \"shipping_address\": \"123 Main St\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forders\u002Fconfirm\"\n\n# Skip MFA step\n# Instead of: Login → MFA → Dashboard\n# Try: Login → Dashboard (skip MFA)\n# After successful password auth, directly access protected resources\n\n# Skip approval process\n# Instead of: Submit request → Manager approval → Access granted\n# Try: Submit request → Access granted (skip approval)\n\n# Repeat a step that should be one-time\n# Apply same coupon code multiple times\nfor i in $(seq 1 5); do\n  curl -s -X POST \\\n    -H \"Authorization: Bearer $TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"coupon_code\": \"DISCOUNT50\"}' \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fapply-coupon\"\n  echo \"Attempt $i\"\ndone\n```\n\n### Step 4: Test Race Conditions in Business Logic\n\nExploit timing windows in concurrent request processing.\n\n```bash\n# Race condition on coupon application\n# Send multiple identical requests simultaneously\nfor i in $(seq 1 10); do\n  curl -s -X POST \\\n    -H \"Authorization: Bearer $TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"coupon_code\": \"ONETIME50\"}' \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fapply-coupon\" &\ndone\nwait\n\n# Race condition on balance transfer\n# If user has $100, try to transfer $100 to two accounts simultaneously\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\": \"user_b\", \"amount\": 100}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Ftransfer\" &\n\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\": \"user_c\", \"amount\": 100}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Ftransfer\" &\nwait\n\n# Race condition on reward claiming\n# Using Burp Turbo Intruder for precise timing:\n# 1. Send request to Turbo Intruder\n# 2. Use race condition script template\n# 3. Send 20+ requests simultaneously\n# 4. Check if reward was claimed multiple times\n```\n\n### Step 5: Test Referral and Reward System Abuse\n\nFind ways to exploit promotional features and reward mechanisms.\n\n```bash\n# Self-referral: refer your own email\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"referral_email\": \"myown@email.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freferrals\u002Finvite\"\n\n# Referral code reuse across multiple accounts\n# Create multiple accounts and use same referral code\n\n# Coupon stacking: apply multiple discount codes\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"coupon_codes\": [\"SAVE10\", \"WELCOME20\", \"VIP50\"]}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fapply-coupons\"\n\n# Abuse free trial: re-register with same details\n# Test if email+1@domain.com or email@domain.com bypass duplicate detection\n\n# Gift card \u002F credit manipulation\n# Buy gift card with gift card balance (circular)\n# Apply gift card with value > purchase price (get change as credit)\n\n# Test reward point manipulation\n# Earn points on order → Cancel order → Keep points\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forders\u002F12345\u002Fcancel\"\n# Check if reward points from order 12345 were revoked\n```\n\n### Step 6: Test Role and Permission Logic\n\nAssess authorization logic for privilege escalation through business processes.\n\n```bash\n# Role escalation via registration parameter\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"test@test.com\",\"password\":\"Test1234!\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fauth\u002Fregister\"\n\n# Organization tenant boundary testing\n# User in Org A tries to access Org B resources via business workflows\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN_ORG_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"org_id\": \"org_b_id\", \"action\": \"view_reports\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freports\"\n\n# Test for privilege retention after role downgrade\n# Admin → Regular user: can they still access admin functions?\n# Employee → Terminated: can they still access company resources?\n\n# Test invitation\u002Fdelegation abuse\n# Invite user with higher privileges than inviter has\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $REGULAR_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"new@test.com\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002Finvite\"\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Business Logic Flaw** | A vulnerability in the application's workflow or rules that allows unintended actions |\n| **Price Manipulation** | Modifying price, quantity, or total values in client-side requests |\n| **Workflow Bypass** | Skipping required steps in a multi-step business process |\n| **Race Condition** | Exploiting concurrent request processing to violate business constraints |\n| **Privilege Escalation** | Gaining higher permissions through business process manipulation |\n| **Negative Testing** | Testing with unexpected values (negative, zero, null, extreme) |\n| **State Manipulation** | Changing application state in an order not intended by the business logic |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception, modification, and sequence testing |\n| **Burp Turbo Intruder** | High-speed request sending for race condition testing |\n| **Burp Sequencer** | Token randomness analysis for predictable reference testing |\n| **OWASP ZAP** | Open-source alternative for proxy-based testing |\n| **Postman** | Workflow testing with collection runners and environment variables |\n| **Custom scripts** | Python\u002Fbash scripts for automated business logic testing |\n\n## Common Scenarios\n\n### Scenario 1: Coupon Code Stacking\nAn e-commerce site allows applying multiple coupon codes. By stacking \"WELCOME10\", \"SAVE20\", and \"VIP30\", the total discount exceeds the product price, resulting in a negative balance or free order.\n\n### Scenario 2: Race Condition on Fund Transfer\nA banking application checks balance before transfer but does not lock the account. Sending two simultaneous $1000 transfers from a $1000 balance results in both succeeding, creating money from nothing.\n\n### Scenario 3: Checkout Price Override\nThe checkout flow sends the total amount in the POST body. Intercepting and changing the total from $499.99 to $0.01 results in a successful order at the manipulated price.\n\n### Scenario 4: Password Reset Token Reuse\nThe password reset flow generates a one-time token but does not invalidate it after use. The same token can be used repeatedly to reset the password.\n\n## Output Format\n\n```\n## Business Logic Vulnerability Finding\n\n**Vulnerability**: Price Manipulation in Checkout Flow\n**Severity**: Critical (CVSS 9.1)\n**Location**: POST \u002Fapi\u002Fcheckout - `total` parameter\n**OWASP Category**: A04:2021 - Insecure Design\n\n### Reproduction Steps\n1. Add item to cart (price: $499.99)\n2. Proceed to checkout\n3. Intercept POST \u002Fapi\u002Fcheckout request in Burp\n4. Modify \"total\" from 499.99 to 0.01\n5. Forward the request; order completes at $0.01\n\n### Business Rules Violated\n| Rule | Expected | Actual |\n|------|----------|--------|\n| Server-side price calculation | Total computed server-side | Client-submitted total accepted |\n| Coupon single use | One coupon per order | Same coupon applied 5 times |\n| Negative quantity check | Quantity >= 1 | Quantity -1 accepted (credit issued) |\n| Race condition on transfer | Balance checked atomically | Dual transfer exceeded balance |\n\n### Impact\n- Financial loss: orders processed at attacker-controlled prices\n- Inventory loss: products shipped for $0.01\n- Reward abuse: unlimited referral credits via self-referral\n- Double-spending via race condition on transfers\n\n### Recommendation\n1. Perform all price calculations server-side; never trust client-submitted totals\n2. Implement server-side validation for quantity (positive integers only)\n3. Use database-level locks or atomic transactions for financial operations\n4. Implement idempotency keys to prevent duplicate transaction processing\n5. Rate-limit and log coupon applications, referral submissions, and transfers\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Testing for Business Logic Vulnerabilities\n\n## When to Use\n\n- During authorized penetration tests when automated scanners have found few technical vulnerabilities\n- When assessing e-commerce platforms for pricing, cart, and payment flow manipulations\n- For testing multi-step workflows (registration, checkout, approval processes) for bypass opportunities\n- When evaluating rate-limited features like vouchers, coupons, referrals, and rewards systems\n- During security assessments of financial applications, voting systems, or any application with critical business rules\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement covering business logic testing\n- **Burp Suite Professional**: For intercepting and modifying multi-step request flows\n- **Application understanding**: Thorough knowledge of the application's intended business workflows\n- **Multiple test accounts**: Accounts at different privilege levels and states\n- **Browser DevTools**: For examining client-side validation logic\n- **Documentation**: Business requirements or user stories describing expected behavior\n\n## Workflow\n\n### Step 1: Map Business Workflows and Rules\n\nDocument all critical business processes and their expected constraints.\n\n```\n# Critical business flows to map:\n# 1. Registration\u002FOnboarding flow\n#    - Email verification requirements\n#    - Account approval process\n#    - Role assignment logic\n\n# 2. E-commerce\u002FPurchase flow\n#    - Product selection → Cart → Checkout → Payment → Confirmation\n#    - Price calculation logic\n#    - Discount\u002Fcoupon application\n#    - Quantity limits\n#    - Shipping cost calculation\n\n# 3. Authentication\u002FAuthorization flow\n#    - Login → MFA → Dashboard\n#    - Password reset → Token → New password\n#    - Role escalation\u002Fapproval\n\n# 4. Financial transactions\n#    - Balance check → Transfer → Confirmation\n#    - Withdrawal limits\n#    - Currency conversion\n\n# Document expected constraints:\n# - Minimum order amounts\n# - Maximum quantity per item\n# - Coupon usage limits (one per user)\n# - Referral reward caps\n# - Withdrawal daily limits\n# - Account verification requirements before certain actions\n```\n\n### Step 2: Test Price and Quantity Manipulation\n\nIntercept and modify price, quantity, and total values in requests.\n\n```bash\n# Test negative quantity\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": -1, \"price\": 99.99}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Test zero price\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": 1, \"price\": 0}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Test extremely large quantity\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": 999999999}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Test decimal\u002Ffloat manipulation\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": 0.001, \"price\": 0.01}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Test integer overflow\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"product_id\": 1, \"quantity\": 2147483647}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fadd\"\n\n# Modify total amount directly in checkout request\n# Intercept in Burp and change total from 299.99 to 0.01\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"cart_id\": \"abc123\", \"total\": 0.01, \"payment_method\": \"card\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcheckout\"\n```\n\n### Step 3: Test Workflow Step Bypass\n\nAttempt to skip required steps in multi-step processes.\n\n```bash\n# Skip email verification\n# Instead of: Register → Verify email → Access dashboard\n# Try: Register → Access dashboard directly\ncurl -s -H \"Authorization: Bearer $UNVERIFIED_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fdashboard\"\n\n# Skip payment step\n# Instead of: Cart → Shipping → Payment → Confirmation\n# Try: Cart → Confirmation (skip payment)\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"cart_id\": \"abc123\", \"shipping_address\": \"123 Main St\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forders\u002Fconfirm\"\n\n# Skip MFA step\n# Instead of: Login → MFA → Dashboard\n# Try: Login → Dashboard (skip MFA)\n# After successful password auth, directly access protected resources\n\n# Skip approval process\n# Instead of: Submit request → Manager approval → Access granted\n# Try: Submit request → Access granted (skip approval)\n\n# Repeat a step that should be one-time\n# Apply same coupon code multiple times\nfor i in $(seq 1 5); do\n  curl -s -X POST \\\n    -H \"Authorization: Bearer $TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"coupon_code\": \"DISCOUNT50\"}' \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fapply-coupon\"\n  echo \"Attempt $i\"\ndone\n```\n\n### Step 4: Test Race Conditions in Business Logic\n\nExploit timing windows in concurrent request processing.\n\n```bash\n# Race condition on coupon application\n# Send multiple identical requests simultaneously\nfor i in $(seq 1 10); do\n  curl -s -X POST \\\n    -H \"Authorization: Bearer $TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"coupon_code\": \"ONETIME50\"}' \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fapply-coupon\" &\ndone\nwait\n\n# Race condition on balance transfer\n# If user has $100, try to transfer $100 to two accounts simultaneously\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\": \"user_b\", \"amount\": 100}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Ftransfer\" &\n\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\": \"user_c\", \"amount\": 100}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Ftransfer\" &\nwait\n\n# Race condition on reward claiming\n# Using Burp Turbo Intruder for precise timing:\n# 1. Send request to Turbo Intruder\n# 2. Use race condition script template\n# 3. Send 20+ requests simultaneously\n# 4. Check if reward was claimed multiple times\n```\n\n### Step 5: Test Referral and Reward System Abuse\n\nFind ways to exploit promotional features and reward mechanisms.\n\n```bash\n# Self-referral: refer your own email\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"referral_email\": \"myown@email.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freferrals\u002Finvite\"\n\n# Referral code reuse across multiple accounts\n# Create multiple accounts and use same referral code\n\n# Coupon stacking: apply multiple discount codes\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"coupon_codes\": [\"SAVE10\", \"WELCOME20\", \"VIP50\"]}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fcart\u002Fapply-coupons\"\n\n# Abuse free trial: re-register with same details\n# Test if email+1@domain.com or email@domain.com bypass duplicate detection\n\n# Gift card \u002F credit manipulation\n# Buy gift card with gift card balance (circular)\n# Apply gift card with value > purchase price (get change as credit)\n\n# Test reward point manipulation\n# Earn points on order → Cancel order → Keep points\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forders\u002F12345\u002Fcancel\"\n# Check if reward points from order 12345 were revoked\n```\n\n### Step 6: Test Role and Permission Logic\n\nAssess authorization logic for privilege escalation through business processes.\n\n```bash\n# Role escalation via registration parameter\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"test@test.com\",\"password\":\"Test1234!\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fauth\u002Fregister\"\n\n# Organization tenant boundary testing\n# User in Org A tries to access Org B resources via business workflows\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $TOKEN_ORG_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"org_id\": \"org_b_id\", \"action\": \"view_reports\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freports\"\n\n# Test for privilege retention after role downgrade\n# Admin → Regular user: can they still access admin functions?\n# Employee → Terminated: can they still access company resources?\n\n# Test invitation\u002Fdelegation abuse\n# Invite user with higher privileges than inviter has\ncurl -s -X POST \\\n  -H \"Authorization: Bearer $REGULAR_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"new@test.com\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002Finvite\"\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Business Logic Flaw** | A vulnerability in the application's workflow or rules that allows unintended actions |\n| **Price Manipulation** | Modifying price, quantity, or total values in client-side requests |\n| **Workflow Bypass** | Skipping required steps in a multi-step business process |\n| **Race Condition** | Exploiting concurrent request processing to violate business constraints |\n| **Privilege Escalation** | Gaining higher permissions through business process manipulation |\n| **Negative Testing** | Testing with unexpected values (negative, zero, null, extreme) |\n| **State Manipulation** | Changing application state in an order not intended by the business logic |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception, modification, and sequence testing |\n| **Burp Turbo Intruder** | High-speed request sending for race condition testing |\n| **Burp Sequencer** | Token randomness analysis for predictable reference testing |\n| **OWASP ZAP** | Open-source alternative for proxy-based testing |\n| **Postman** | Workflow testing with collection runners and environment variables |\n| **Custom scripts** | Python\u002Fbash scripts for automated business logic testing |\n\n## Common Scenarios\n\n### Scenario 1: Coupon Code Stacking\nAn e-commerce site allows applying multiple coupon codes. By stacking \"WELCOME10\", \"SAVE20\", and \"VIP30\", the total discount exceeds the product price, resulting in a negative balance or free order.\n\n### Scenario 2: Race Condition on Fund Transfer\nA banking application checks balance before transfer but does not lock the account. Sending two simultaneous $1000 transfers from a $1000 balance results in both succeeding, creating money from nothing.\n\n### Scenario 3: Checkout Price Override\nThe checkout flow sends the total amount in the POST body. Intercepting and changing the total from $499.99 to $0.01 results in a successful order at the manipulated price.\n\n### Scenario 4: Password Reset Token Reuse\nThe password reset flow generates a one-time token but does not invalidate it after use. The same token can be used repeatedly to reset the password.\n\n## Output Format\n\n```\n## Business Logic Vulnerability Finding\n\n**Vulnerability**: Price Manipulation in Checkout Flow\n**Severity**: Critical (CVSS 9.1)\n**Location**: POST \u002Fapi\u002Fcheckout - `total` parameter\n**OWASP Category**: A04:2021 - Insecure Design\n\n### Reproduction Steps\n1. Add item to cart (price: $499.99)\n2. Proceed to checkout\n3. Intercept POST \u002Fapi\u002Fcheckout request in Burp\n4. Modify \"total\" from 499.99 to 0.01\n5. Forward the request; order completes at $0.01\n\n### Business Rules Violated\n| Rule | Expected | Actual |\n|------|----------|--------|\n| Server-side price calculation | Total computed server-side | Client-submitted total accepted |\n| Coupon single use | One coupon per order | Same coupon applied 5 times |\n| Negative quantity check | Quantity >= 1 | Quantity -1 accepted (credit issued) |\n| Race condition on transfer | Balance checked atomically | Dual transfer exceeded balance |\n\n### Impact\n- Financial loss: orders processed at attacker-controlled prices\n- Inventory loss: products shipped for $0.01\n- Reward abuse: unlimited referral credits via self-referral\n- Double-spending via race condition on transfers\n\n### Recommendation\n1. Perform all price calculations server-side; never trust client-submitted totals\n2. Implement server-side validation for quantity (positive integers only)\n3. Use database-level locks or atomic transactions for financial operations\n4. Implement idempotency keys to prevent duplicate transaction processing\n5. Rate-limit and log coupon applications, referral submissions, and transfers\n```\n",{"hide":52,"name":5,"source":53,"license":15,"description":7,"authorized_lab":48,"origin_frontmatter":54},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: testing-for-business-logic-vulnerabilities | description: Identifying flaws in application business logic that allow price manipulation, |   workflow bypass, and privilege escalation beyond what technical vulnerability scanners |   can detect. | domain: cybersecurity | subdomain: web-application-security | tags: | - penetration-testing | - business-logic | - owasp | - web-security | - burpsuite | - manual-testing | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - PR.P","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-testing-for-business-logic-vulnerabilities",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-10-27 02:18:29",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":52},[65,68,71],{"tool":66,"command":67},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-testing-for-business-logic-vulnerabilities",{"tool":69,"command":70},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-testing-for-business-logic-vulnerabilities",{"tool":72,"command":73},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-testing-for-business-logic-vulnerabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-testing-for-business-logic-vulnerabilities\u002FSKILL.md",[],[77,101,123,151,180,199],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":47},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":47},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[108,109,88,110,111,28,112,113,114,115,116,94,117,96,44,118,119,120,121,122],"yuri shura","parallel","architecture review","planning","deployment","vector","strategic review","decision","strategic","ops","decisions","architecture","review","perspectives","adversarial",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":132,"publishedAt":47},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[129],{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[133,134,135,136,137,138,139,140,141,96,142,143,144,145,146,147,148,28,149,150],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":165,"publishedAt":47},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[157,160],{"categoryNo":158,"categoryName":159,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":161,"categoryName":162,"taxonomyType":163,"taxonomyTypeDesc":164},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[166,98,167,133,88,168,169,170,28,171,172,173,174,175,176,177,178,179,94,96],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":47},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[187,188,189,190,191,192,193,194,195,96,196,44,197,198],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":213,"publishedAt":47},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[205,206,209,210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":207,"categoryName":208,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":211,"categoryName":212,"taxonomyType":163,"taxonomyTypeDesc":164},"01JBSEEDCAT000000000000036","内容创作者",[214,215,216,96,44,217,88,218,112,94,219],"writing","writing skills","new","work","editing","Existing"]