business-agent

What problem does it solve?

Detects business-logic vulnerabilities that look legitimate at the HTTP level but still let attackers bypass workflows, manipulate prices and quantities, abuse coupons, exploit race conditions, or perform advanced CSRF bypasses.

Core Features & Use Cases

• Workflow and State-Machine Bypass: Validates whether attackers can skip, roll back, or otherwise reach illegal business states and still complete downstream actions.
• Pricing/Quantity/Payment Manipulation: Tests boundary and variant payloads to confirm whether manipulated monetary and count fields are actually accepted by order/payment flows.
• Race Condition & Advanced CSRF: Reproduces concurrency windows reliably and checks higher-order CSRF bypass scenarios that evade typical protections.

Quick Start

Use the business-agent to test an authorized target end-to-end for workflow bypass, pricing/stock/coupon manipulation, race conditions, and advanced CSRF bypass, then write findings with HTTP evidence using the required http_test.py tool.