Business Logic Vulnerabilities

This is the playbook for finding bugs scanners never catch: race conditions, price manipulation, workflow bypasses, and state machine gaps. You load it when hunting business logic flaws in checkout flows, coupon systems, multi-step auth, or anywhere trust lives client-side. The main file gives you the attack surface (negative quantities, integer overflows, decimal exploits), METHODOLOGY.md walks through the five-phase workflow and attack matrix, CHECKLIST.md has per-module line items, and SCENARIOS.md drills into payment precision bugs, captcha bypass, password reset flaws, and Turbo Intruder patterns for SMS bombing. Real cases included, like the 0.02 quantity trick that bought ¥500 items for ¥10. This is human-reasoning work, not automation.

skills.sh installs: 4.1K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill business-logic-vulnerabilities --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Business Logic Vulnerabilities — Expert Attack Playbook

AI LOAD INSTRUCTION: Business logic flaws are scanner-invisible and high-reward on bug bounty. This skill covers race conditions, price manipulation, workflow bypass, coupon/referral abuse, negative values, and state machine attacks. These require human reasoning, not automation. For specific exploitation techniques (payment precision/overflow, captcha bypass, password reset flaws, user enumeration), load the companion SCENARIOS.md. For the workflow approach itself (modeling → state machine → attack-surface matrix → human judgement) load METHODOLOGY.md. For the per-module check items load CHECKLIST.md.