What problem does it solve? Business logic vulnerabilities are invisible to automated scanners and require structured human reasoning to uncover. This Skill provides a systematic playbook for finding payment manipulation, race conditions, workflow bypass, coupon abuse, and authorization gaps in authorized web application security assessments. ## Core Features & Use Cases - Attack Playbook: Covers price/quantity tampering, integer overflow, decimal precision exploitation, race conditions (double-spend, coupon reuse), multi-step workflow skipping, and privilege escalation patterns. - Five-Phase Methodology: Business modeling, state machine analysis, a 5×N attack-surface matrix, checklist-driven testing, and human judgement with a Q1-Q7 decision tree. - Module Checklists: Per-module verification items for login, registration, password recovery, payment, coupons, orders, IDOR, captcha, file upload, and CSRF/SSRF/XXE, each with root cause and reproduction steps. - Use Case: During an authorized pentest of an e-commerce platform, use the payment checklist to test negative quantities, decimal skuQty values, and concurrent coupon application with Burp Suite to uncover a 0-yuan purchase flaw. ## Quick Start Use the business-logic-vulnerabilities skill to test this checkout flow for price tampering, race conditions, and payment status forgery.
