skills.rest
jd-opensource
jd-opensourceOFFICIAL
Explore all skills by this author →
WebsiteGitHub

pentest-business-logic

Identify and test business logic vulnerabilities in web applications and APIs.

299|56|Updated Jan 13, 2026
Search Tags:#workflow#vulnerability#playwright#business-logic#security-testing#burp#WSTG
One-click install
npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-business-logic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentest-business-logic
Source: https://github.com/jd-opensource/JoySafeter/tree/main/skills/pentest-business-logic
Command: npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-business-logic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Identify and test business logic vulnerabilities that arise from flawed workflow enforcement, inappropriate rule validation, and brittle state-machine behavior in applications.

Core Features & Use Cases

  • Workflow Mapping: Map multi-step processes (checkout, onboarding, approvals) from recon deliverables and source code, documenting expected state transitions and constraints.
  • Rule Extraction: Identify server-side business constraints (pricing, quantity, role gating, time-based rules, discounts) to validate enforceability.
  • Step Circumvention: Attempt to bypass prerequisite steps, reorder actions, or replay complete flows to verify server-side safeguards.
  • Data Integrity Abuse: Submit boundary and crafted inputs (negative quantities, zero prices, type confusion) to reveal validation gaps.
  • Function Limit Bypass: Test per-user or per-session limits (coupon uses, referrals, votes) under stress or parallel requests.
  • File Upload Logic: Assess file type handling and payload boundaries for uploads, including polyglot considerations.
  • Payment Testing: Validate price calculations, discounts, and payment state transitions across the flow.

Quick Start

Run a controlled business-logic security assessment on a target application by mapping workflows and validating constraints with Burp and Playwright.

Frequently Asked Questions about pentest-business-logic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test business logic vulnerabilities in web application workflows?▼

Business logic vulnerabilities arise when flawed workflow enforcement allows bypassing prerequisite steps or state-machine constraints. You can identify them by mapping expected state transitions and testing rule validation across application flows.

How do I bypass checkout and payment state transitions to find validation gaps?▼

You bypass payment state transitions by attempting to reorder actions, skip prerequisite steps, or submit crafted inputs like negative quantities and zero prices to reveal validation gaps in the checkout flow.

Does this business logic testing approach support WSTG mappings and Burp?▼

Yes, this approach supports structured assessment using WSTG mappings and executes per-pattern test vectors with Burp, Playwright, and Python scripts to validate server-side business constraints.

How do I test function limit bypasses for coupons and referral votes?▼

You test function limit bypasses by sending parallel requests or applying stress to per-user limits like coupon uses and referral votes, verifying whether server-side safeguards prevent limit abuse under load.

What is the best way to assess file upload logic and payload boundaries?▼

Assess file upload logic by testing file type handling and payload boundaries for uploads, including polyglot considerations, to verify that server-side validation correctly restricts malicious payloads.

Related Skills

Explore More Software Engineering Skills→
andrescardonas7andrescardonas7

wycheproof

Validate cryptographic implementations against Wycheproof test vectors.

Community
Advanced
johnatas-henriquejohnatas-henrique

security-audit

Audit game codebases for security vulnerabilities and generate prioritized remediation reports.

Community
Advanced
Svenja-devSvenja-dev
38

e2e-testing

Automate end-to-end browser testing for web applications with Playwright MCP.

Community
Intermediate
uphiagouphiago
1.1k

hunt-graphql

Identify and validate high-severity GraphQL vulnerabilities including IDOR, SSRF, and auth bypass.

Community
Advanced