sast-businesslogic

Name: sast-businesslogic
Author: utkusen

39installs56forks

How to install sast-businesslogic?

utkusen/sast-skills/sast-businesslogic

$npx -y skills add utkusen/sast-skills --skill sast-businesslogic

Installs into the current project.

Summary

Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results). Covers price manipulat

Files · 1

View on GitHub

SKILL.md

1	# Business Logic Vulnerability Detection
2
3	You are performing a focused security assessment to find business logic vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: threat modeling (understand the domain and generate attack scenarios), batched verify (check whether scenarios are exploitable in parallel batches of 3), and merge (consolidate batch results).
4
5	Prerequisites: `sast/architecture.md` must exist. Run the analysis skill first if it doesn't.
6
7	---
8
9	## What are Business Logic Vulnerabilities
10
11	Business logic vulnerabilities arise when an application's intended workflow, rules, or constraints can be manipulated to produce unintended outcomes — without exploiting technical flaws like injection or memory corruption. The attacker operates within the application's own features but uses them in ways the developers did not anticipate.
12
13	The core pattern: the application accepts input that is syntactically valid and passes authentication/authorization, but violates a business rule that was never enforced in code.
14
15	### What Business Logic Vulnerabilities ARE
16
17	- Submitting a negative quantity to a purchase endpoint, receiving a credit instead of a charge
18	- Applying the same one-time discount coupon multiple times in parallel requests
19	- Skipping the payment step in a multi-step checkout by replaying a later step's request
20	- Posting a rating of 9999 to a movie rating endpoint that should cap ratings at 5
21	- Transferring a negative amount to move money from the recipient to the sender
22	- Redeeming a referral bonus by referring yourself with a second account
23	- Re-using a single-use reset token or voucher that was never invalidated
24	- Purchasing an item that is out of stock due to a race condition between inventory check and reservation
25	- Accessing a premium subscription feature after downgrading to a free plan
26	- Winning an auction by retracting a high bid after others have been eliminated
27
28	### What Business Logic Vulnerabilities are NOT
29
30	Do not flag these as business logic issues:
31
32	- SQL injection, XSS, RCE, XXE, SSRF, SSTI: These are injection/technical flaws — separate skills cover them
33	- Missing authentication: Endpoint requires no login at all → that's "Unauthenticated Access"
34	- IDOR: Accessing another user's resource by changing an ID → that's a separate access-control class
35	- Brute-force / rate limiting: Generic rate-limit bypass on login → that's not a business logic flaw unless it enables specific business rule circumvention
36
37	---
38
39	## Business Logic Attack Categories
40
41	Use these categories to guide threat modeling. Not all categories apply to every application — identify which ones are relevant based on the architecture summary.
42
43	### 1. Price & Payment Manipulation
44	- Negative prices or zero prices on purchase endpoints
45	- Arbitrary price override in request body (mass assignment of price field)
46	- Currency or unit confusion (e.g., cents vs. dollars)
47	- Floating-point precision abuse in monetary arithmetic
48	- Applying discounts that reduce total below zero
49
50	### 2. Quantity & Numeric Limit Violations
51	- Negative quantities (ordering −5 items to receive a credit)
52	- Quantities exceeding per-user or per-order limits
53	- Integer overflow/underflow in quantity or balance calculations
54	- Out-of-range values for bounded fields (ratings, scores, percentages)
55
56	### 3. Workflow & Multi-Step Process Bypass
57	- Skipping mandatory steps in a sequential process (payment, email verification, ID check)
58	- Replaying a completion token from a previous successful flow to bypass steps
59	- Direct-access to a later-stage endpoint without completing earlier stages
60	- Submitting a terminal state transition without going through intermediate states (state machine violations)
61
62	### 4. Coupon, Discount & Voucher Abuse
63	- Applying the same coupon multiple times (single-use not enforced)
64	- Stacking discounts that were not intended to be combined
65	- Using an expired coupon or voucher
66	- Generating or guessing valid coupon codes
67
68	### 5. Race Conditions & Concurrency Abuse
69	- Double-spending: sending two concurrent purchase requests to consume a balance once
70	- Concurrent coupon redemption draining credit beyond allowed amount
71	- TOCTOU (time-of-check / time-of-use) on inventory: check passes for both requests, both reservations succeed
72	- Parallel withdrawal/transfer requests exceeding account balance
73
74	##

People who liked this also viewed

6 picks

Type

sast-businesslogic

39installs56forks

View on GitHub

How to install sast-businesslogic?

utkusen/sast-skills/sast-businesslogic

$npx -y skills add utkusen/sast-skills --skill sast-businesslogic

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Business Logic Vulnerability Detection
2
3	You are performing a focused security assessment to find business logic vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: threat modeling (understand the domain and generate attack scenarios), batched verify (check whether scenarios are exploitable in parallel batches of 3), and merge (consolidate batch results).
4
5	Prerequisites: `sast/architecture.md` must exist. Run the analysis skill first if it doesn't.
6
7	---
8
9	## What are Business Logic Vulnerabilities
10
11	Business logic vulnerabilities arise when an application's intended workflow, rules, or constraints can be manipulated to produce unintended outcomes — without exploiting technical flaws like injection or memory corruption. The attacker operates within the application's own features but uses them in ways the developers did not anticipate.
12
13	The core pattern: the application accepts input that is syntactically valid and passes authentication/authorization, but violates a business rule that was never enforced in code.
14
15	### What Business Logic Vulnerabilities ARE
16
17	- Submitting a negative quantity to a purchase endpoint, receiving a credit instead of a charge
18	- Applying the same one-time discount coupon multiple times in parallel requests
19	- Skipping the payment step in a multi-step checkout by replaying a later step's request
20	- Posting a rating of 9999 to a movie rating endpoint that should cap ratings at 5
21	- Transferring a negative amount to move money from the recipient to the sender
22	- Redeeming a referral bonus by referring yourself with a second account
23	- Re-using a single-use reset token or voucher that was never invalidated
24	- Purchasing an item that is out of stock due to a race condition between inventory check and reservation
25	- Accessing a premium subscription feature after downgrading to a free plan
26	- Winning an auction by retracting a high bid after others have been eliminated
27
28	### What Business Logic Vulnerabilities are NOT
29
30	Do not flag these as business logic issues:
31
32	- SQL injection, XSS, RCE, XXE, SSRF, SSTI: These are injection/technical flaws — separate skills cover them
33	- Missing authentication: Endpoint requires no login at all → that's "Unauthenticated Access"
34	- IDOR: Accessing another user's resource by changing an ID → that's a separate access-control class
35	- Brute-force / rate limiting: Generic rate-limit bypass on login → that's not a business logic flaw unless it enables specific business rule circumvention
36
37	---
38
39	## Business Logic Attack Categories
40
41	Use these categories to guide threat modeling. Not all categories apply to every application — identify which ones are relevant based on the architecture summary.
42
43	### 1. Price & Payment Manipulation
44	- Negative prices or zero prices on purchase endpoints
45	- Arbitrary price override in request body (mass assignment of price field)
46	- Currency or unit confusion (e.g., cents vs. dollars)
47	- Floating-point precision abuse in monetary arithmetic
48	- Applying discounts that reduce total below zero
49
50	### 2. Quantity & Numeric Limit Violations
51	- Negative quantities (ordering −5 items to receive a credit)
52	- Quantities exceeding per-user or per-order limits
53	- Integer overflow/underflow in quantity or balance calculations
54	- Out-of-range values for bounded fields (ratings, scores, percentages)
55
56	### 3. Workflow & Multi-Step Process Bypass
57	- Skipping mandatory steps in a sequential process (payment, email verification, ID check)
58	- Replaying a completion token from a previous successful flow to bypass steps
59	- Direct-access to a later-stage endpoint without completing earlier stages
60	- Submitting a terminal state transition without going through intermediate states (state machine violations)
61
62	### 4. Coupon, Discount & Voucher Abuse
63	- Applying the same coupon multiple times (single-use not enforced)
64	- Stacking discounts that were not intended to be combined
65	- Using an expired coupon or voucher
66	- Generating or guessing valid coupon codes
67
68	### 5. Race Conditions & Concurrency Abuse
69	- Double-spending: sending two concurrent purchase requests to consume a balance once
70	- Concurrent coupon redemption draining credit beyond allowed amount
71	- TOCTOU (time-of-check / time-of-use) on inventory: check passes for both requests, both reservations succeed
72	- Parallel withdrawal/transfer requests exceeding account balance
73
74	##

People who liked this also viewed

6 picks

Type