What problem does it solve?
Traditional security testing often misses subtle business logic vulnerabilities (BLVs) that attackers exploit. This Skill provides a comprehensive attacker's mindset and a library of universal BLV patterns to identify these critical flaws, helping you build and test more secure systems.
Core Features & Use Cases
- Attacker's Perspective: Guides you to think beyond intended functionality, focusing on "legally permitted but unintended" actions that can compromise a system.
- Economic Exploits: Identify vulnerabilities related to negative values, extreme values, abusive multiplication (e.g., stackable promo codes), and double-spend scenarios in financial or transactional systems.
- Workflow Bypass & Temporal Attacks: Discover ways to skip steps in a process, reverse workflow order, replay actions, exploit race conditions, and manipulate timestamps to bypass cooldowns or trigger events prematurely.
- Privilege Escalation: Uncover methods to change roles via parameters, access unauthorized resources (IDOR), or combine features of different roles for unintended privileges.
- Universal BLV Patterns: Learn from real-world examples like weak reference ID binding, token replay cross-operation, and race conditions on validation, applicable across various targets.
Quick Start
Analyze the attached payment processing API for business logic vulnerabilities, specifically looking for economic exploits and race conditions.
