skills.rest
ZhuATT
ZhuATTCOMMUNITY
Explore all skills by this author →
GitHub

wooyun-legacy

Map workflows and apply domain-specific attack patterns to identify business-logic vulnerabilities.

71|3|Updated Mar 19, 2026
Search Tags:#authorization#authentication#pentesting#business-logic#security-audit#wooyun#vulnerability-matrix
One-click install
npx skills add https://github.com/ZhuATT/CTFer --skill wooyun-legacy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wooyun-legacy
Source: https://github.com/ZhuATT/CTFer/tree/main/wooyun/plugins/wooyun-legacy/skills/wooyun-legacy
Command: npx skills add https://github.com/ZhuATT/CTFer --skill wooyun-legacy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

The WooYun methodology helps security practitioners identify and prioritize business-logic vulnerabilities that scanners often miss, enabling more effective audits and risk reduction.

Core Features & Use Cases

  • Domain-driven vulnerability framework across authentication, authorization, finance, information, logic flow, and configuration.
  • Practical testing guides, field-tested patterns, and remediation-oriented strategies drawn from WooYun cases.
  • Use cases include validating multi-step processes, IDOR/privilege escalation, and financial logic security in web apps and APIs.

Quick Start

Start by mapping a target's business processes and applying domain-specific patterns to uncover logic flaws and verify fixes.

Frequently Asked Questions about wooyun-legacy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for business-logic vulnerabilities in web applications?▼

Testing for business-logic vulnerabilities involves mapping application workflows and applying domain-specific attack patterns to bypass business rules across authentication, authorization, and financial domains.

What is a business-logic vulnerability and how do scanners miss them?▼

A business-logic vulnerability is a design flaw where application rules can be bypassed. Automated scanners often miss them because they require manual workflow mapping to evaluate logic flaws.

How can I identify IDOR and privilege escalation vulnerabilities during a security audit?▼

Identify IDOR and privilege escalation vulnerabilities by mapping business processes and applying domain-specific patterns to evaluate authorization bypasses, documenting evidence and remediation steps.

Does manual pentesting work for finding financial logic flaws in APIs?▼

Manual pentesting works for financial logic flaws in APIs by validating multi-step processes and applying field-tested attack patterns to assess risk and verify fixes.

What are the limitations of automated security audits for logic-flow vulnerabilities?▼

Automated security audits for logic-flow vulnerabilities are limited because they cannot map complex business workflows or understand context, requiring manual testing to uncover bypasses and assess configuration risks.

Related Skills

Explore More Software Engineering Skills→
DorianGalloDorianGallo
5

recon-for-sec

Route reconnaissance workflows for mapping unknown target surfaces.

Community
Basic
zebbernzebbern
5

markdown-report

Generate markdown vulnerability reports with a strict template.

Community
Advanced
uphiagouphiago
1.1k

hunt-business-logic

Identify business logic vulnerabilities in e-commerce and payment systems.

Community
Intermediate
rajyeole6rajyeole6

agency-penetration-tester

Conduct authorized penetration testing across network, web, and cloud infrastructure.

Community
Advanced