business-logic-vulnerabilities

Name: business-logic-vulnerabilities
Author: Prohao42

91stars8forks

How to install business-logic-vulnerabilities?

prohao42/aimy-skill/business-logic-vulnerabilities

$npx -y skills add Prohao42/aimy-skill --skill business-logic-vulnerabilities

Installs into the current project.

Summary

--- name: business-logic-vulnerabilities description: >- Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps. ---

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Business Logic Vulnerabilities — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Business logic flaws are scanner-invisible and high-reward on bug bounty. This skill covers race conditions, price manipulation, workflow bypass, coupon/referral abuse, negative values, and state machine attacks. These require human reasoning, not automation. For specific exploitation techniques (payment precision/overflow, captcha bypass, password reset flaws, user enumeration), load the companion [SCENARIOS.md](./SCENARIOS.md). For the workflow approach itself (modeling → state machine → attack-surface matrix → human judgement) load [METHODOLOGY.md](./METHODOLOGY.md). For the per-module check items load [CHECKLIST.md](./CHECKLIST.md).
4
5	### Companion files
6
7	\| File \| When to load \|
8	\|---\|---\|
9	\| [METHODOLOGY.md](./METHODOLOGY.md) \| Need the 5-phase workflow, attack-surface 5×N matrix, human-judgement decision tree \|
10	\| [CHECKLIST.md](./CHECKLIST.md) \| Going through a target module-by-module (login / register / payment / IDOR / privacy) and want every line item with why+verify \|
11	\| [SCENARIOS.md](./SCENARIOS.md) \| Drilling deeper into payment precision/overflow, captcha bypass, password reset, enumeration, frontend bypass \|
12
13	### Extended Scenarios
14
15	Also load [SCENARIOS.md](./SCENARIOS.md) when you need:
16	- Payment precision & integer overflow attacks — 32-bit overflow to negative, decimal rounding exploitation, negative shipping fees
17	- Payment parameter tampering checklist — price, discount, currency, gateway, return_url fields
18	- Condition race practical patterns — parallel coupon application, gift card double-spend with Burp group send
19	- Captcha bypass techniques — drop verification request, remove parameter, clear cookies to reset counter, OCR with tesseract
20	- Arbitrary password reset — predictable tokens (`md5(username)`), session replacement attack, registration overwrite
21	- User information enumeration — login error message difference, masked data reconstruction across endpoints, base64 uid cookie manipulation
22	- Frontend restriction bypass — array parameters for multiple coupons (`couponid[0]`/`couponid[1]`), remove `disabled`/`readonly` attributes
23	- Application-layer DoS patterns — regex backtracking, WebSocket abuse
24
25	---
26
27	## 1. PRICE AND VALUE MANIPULATION
28
29	### Negative Quantity / Price
30	Many applications validate "amount > 0" but not for currency:
31	```
32	Add to cart with quantity: -1
33	Update quantity to: -100
34	{
35	"quantity": -5,
36	"price": -99.99 ← may be accepted
37	}
38	```
39	Impact: Receive credit to account, items for free, bank transfers in reverse.
40
41	### Decimal Quantity — "0元购" Case
42	Real instructor-led case: an e-commerce app accepted fractional `quantity` because backend trusted client float values:
43	```json
44	// Cart item:
45	{"id": 114016, "skuQty": 0.02}
46	// Original price ¥500 → final price ¥10
47	// Variant on a food delivery app:
48	// FoodNum=0.01 → 68元商品实付 0.68元
49	```
50	Why it works: server multiplies `unit_price * quantity` without enforcing `quantity ∈ Z+`, so a 2% sliver order pays 2% price but ships the full item. Reproduce by intercepting the cart submit → setting `skuQty` / `FoodNum` to `0.02` → finishing checkout.
51
52	### Drop a Required Field — Free Tier Coercion
53	Sport activity registration: when paid prizes are involved server returns `"payType": "paid"`; if the client request is edited to omit `prizeIdList` entirely, the server falls back to `"payType": "free"` and creates a successful registration that should have cost money.
54	```json
55	// Original
56	{"prizeIdList": ["6264e6948fe587000113e2d9"], ...}
57	// Modified — array removed entirely
58	{"prizeIdList": [], ...}
59	// Server response:
60	{"ok": true, "payType": "free"}
61	```
62	This is a parameter-existence trust bug — backend treats "field absent" as "no paid item to enforce", so fix is to require the field and validate its content server-side.
63
64	### Integer Overflow
65	```
66	quantity: 2147483648 ← INT_MAX + 1 overflows to negative in 32-bit
67	price: 9999999999999 ← exceeds float precision → rounds to 0
68	```
69	Real case: setting `amount=999999999` triggered an overflow path where the system stored `0` as final payable. Always coordinate before triggering overflow tests — they sometimes crash payment services.
70
71	### Rounding Manipulation
72	```
73	Item price: $0.001
74	Order 1000 items → each rounds down → total = $0.00
75	```
76	Real "half-price recharge" bug: input `¥0.019` to top-up. The pay gateway charges only `¥0.01` (rounded down to the cent), but the wallet credits `¥0.02` (rounded up). Net gain per cycle is `¥0.01`, repeat for free balance growth.
77
78	### Currency Exchange Rate Lag
79	```
80	1. Deposit using currency A at rate X
81	2. Rate changes
82	3. Withdraw using curre

People who liked this also viewed

6 picks

Type

business-logic-vulnerabilities

91stars8forks

View on GitHub

How to install business-logic-vulnerabilities?

prohao42/aimy-skill/business-logic-vulnerabilities

$npx -y skills add Prohao42/aimy-skill --skill business-logic-vulnerabilities

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Business Logic Vulnerabilities — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Business logic flaws are scanner-invisible and high-reward on bug bounty. This skill covers race conditions, price manipulation, workflow bypass, coupon/referral abuse, negative values, and state machine attacks. These require human reasoning, not automation. For specific exploitation techniques (payment precision/overflow, captcha bypass, password reset flaws, user enumeration), load the companion [SCENARIOS.md](./SCENARIOS.md). For the workflow approach itself (modeling → state machine → attack-surface matrix → human judgement) load [METHODOLOGY.md](./METHODOLOGY.md). For the per-module check items load [CHECKLIST.md](./CHECKLIST.md).
4
5	### Companion files
6
7	\| File \| When to load \|
8	\|---\|---\|
9	\| [METHODOLOGY.md](./METHODOLOGY.md) \| Need the 5-phase workflow, attack-surface 5×N matrix, human-judgement decision tree \|
10	\| [CHECKLIST.md](./CHECKLIST.md) \| Going through a target module-by-module (login / register / payment / IDOR / privacy) and want every line item with why+verify \|
11	\| [SCENARIOS.md](./SCENARIOS.md) \| Drilling deeper into payment precision/overflow, captcha bypass, password reset, enumeration, frontend bypass \|
12
13	### Extended Scenarios
14
15	Also load [SCENARIOS.md](./SCENARIOS.md) when you need:
16	- Payment precision & integer overflow attacks — 32-bit overflow to negative, decimal rounding exploitation, negative shipping fees
17	- Payment parameter tampering checklist — price, discount, currency, gateway, return_url fields
18	- Condition race practical patterns — parallel coupon application, gift card double-spend with Burp group send
19	- Captcha bypass techniques — drop verification request, remove parameter, clear cookies to reset counter, OCR with tesseract
20	- Arbitrary password reset — predictable tokens (`md5(username)`), session replacement attack, registration overwrite
21	- User information enumeration — login error message difference, masked data reconstruction across endpoints, base64 uid cookie manipulation
22	- Frontend restriction bypass — array parameters for multiple coupons (`couponid[0]`/`couponid[1]`), remove `disabled`/`readonly` attributes
23	- Application-layer DoS patterns — regex backtracking, WebSocket abuse
24
25	---
26
27	## 1. PRICE AND VALUE MANIPULATION
28
29	### Negative Quantity / Price
30	Many applications validate "amount > 0" but not for currency:
31	```
32	Add to cart with quantity: -1
33	Update quantity to: -100
34	{
35	"quantity": -5,
36	"price": -99.99 ← may be accepted
37	}
38	```
39	Impact: Receive credit to account, items for free, bank transfers in reverse.
40
41	### Decimal Quantity — "0元购" Case
42	Real instructor-led case: an e-commerce app accepted fractional `quantity` because backend trusted client float values:
43	```json
44	// Cart item:
45	{"id": 114016, "skuQty": 0.02}
46	// Original price ¥500 → final price ¥10
47	// Variant on a food delivery app:
48	// FoodNum=0.01 → 68元商品实付 0.68元
49	```
50	Why it works: server multiplies `unit_price * quantity` without enforcing `quantity ∈ Z+`, so a 2% sliver order pays 2% price but ships the full item. Reproduce by intercepting the cart submit → setting `skuQty` / `FoodNum` to `0.02` → finishing checkout.
51
52	### Drop a Required Field — Free Tier Coercion
53	Sport activity registration: when paid prizes are involved server returns `"payType": "paid"`; if the client request is edited to omit `prizeIdList` entirely, the server falls back to `"payType": "free"` and creates a successful registration that should have cost money.
54	```json
55	// Original
56	{"prizeIdList": ["6264e6948fe587000113e2d9"], ...}
57	// Modified — array removed entirely
58	{"prizeIdList": [], ...}
59	// Server response:
60	{"ok": true, "payType": "free"}
61	```
62	This is a parameter-existence trust bug — backend treats "field absent" as "no paid item to enforce", so fix is to require the field and validate its content server-side.
63
64	### Integer Overflow
65	```
66	quantity: 2147483648 ← INT_MAX + 1 overflows to negative in 32-bit
67	price: 9999999999999 ← exceeds float precision → rounds to 0
68	```
69	Real case: setting `amount=999999999` triggered an overflow path where the system stored `0` as final payable. Always coordinate before triggering overflow tests — they sometimes crash payment services.
70
71	### Rounding Manipulation
72	```
73	Item price: $0.001
74	Order 1000 items → each rounds down → total = $0.00
75	```
76	Real "half-price recharge" bug: input `¥0.019` to top-up. The pay gateway charges only `¥0.01` (rounded down to the cent), but the wallet credits `¥0.02` (rounded up). Net gain per cycle is `¥0.01`, repeat for free balance growth.
77
78	### Currency Exchange Rate Lag
79	```
80	1. Deposit using currency A at rate X
81	2. Rate changes
82	3. Withdraw using curre

People who liked this also viewed

6 picks

Type