What problem does it solve?
Business logic flaws allow attackers to abuse intended workflows and state transitions to cause financial loss, privilege retention, or invariant violations that are not detectable by payload-based scanners. This Skill provides a structured approach to identify where application workflows trust the client, rely on fragile sequencing, or allow inconsistent cross-service assumptions.
Core Features & Use Cases
- Workflow mapping: Enumerate states, transitions, tokens, and hidden endpoints to build an actor × action × resource matrix.
- State and timing attacks: Test replay, out-of-order calls, race conditions, and end-of-period edge cases to reveal invariant breaks.
- Cross-service and idempotency checks: Validate that queues, cron jobs, webhooks, and microservices enforce the same business invariants.
- Use Case: Map a payment authorization → capture → refund flow in an e-commerce platform to detect double-refunds, price swaps after approval, or idempotency key misuse.
Quick Start
Map a critical workflow (for example checkout or subscription upgrade), enumerate its states and tokens, then attempt step reordering, replay, and concurrent requests to demonstrate an invariant violation.
