What problem does it solve? Automated scanners cannot detect business logic vulnerabilities such as forged requests, workflow circumvention, or payment manipulation. This Skill provides a structured methodology based on OWASP WSTG v4.2 to manually identify and exploit these application-specific flaws during security assessments. ## Core Features & Use Cases - Nine Structured Test Cases: Covers data validation, forged requests, integrity checks, process timing, function use limits, workflow circumvention, misuse defenses, and malicious file uploads (WSTG-BUSL-01 through BUSL-09). - Vulnerability Pattern Catalog: Documents common flaw patterns like hidden field trust, premature side effects, predictable identifiers, and extension-only upload validation. - Remediation Guidance: Maps each finding category to concrete fixes such as server-side validation, transaction timeouts, and anti-malware scanning. - Use Case: During a penetration test of an e-commerce platform, use this Skill to test whether discounts can be applied multiple times, whether checkout steps can be skipped, and whether a web shell disguised as an image can be uploaded and executed. ## Quick Start Use the wstg-business-logic skill to test this checkout workflow for business logic flaws including discount reuse, step skipping, and forged request parameters.
