mcpField
P
pentest-business-logic-abuse

pentest-business-logic-abuse

github.com/crtvrffnrtSecurity469 installsUpdated 5w ago
Repository

About pentest-business-logic-abuse

pentest-business-logic-abuse is a security testing skill for examining workflow bypasses, race conditions, replay, quota abuse, and unauthorized state changes. It models intended transitions and requires observable impact before reporting a flaw or handing off a confirmed primitive.

Key features

  1. 01Model intended state transitions
  2. 02Test sequencing and concurrency assumptions
  3. 03Verify unauthorized effects
  4. 04Use timing-aware race and replay evidence
  5. 05Design reversible stateful tests
  6. 06Hand off confirmed primitives

Use cases

  1. 01Test whether workflow steps can be skipped
  2. 02Check for race-condition state changes
  3. 03Assess replay or quota abuse
  4. 04Verify unauthorized delegated actions

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/crtvrffnrt/skills --skill pentest-business-logic-abuse

After installing, type/pentest-business-logic-abusein Claude Code to confirm it loaded.

Details

From the project README

Business Logic Abuse

Use When

  • The main question is workflow bypass, race condition, replay, quota abuse, confused deputy behavior, or unauthorized state transition.
  • A mapped workflow has meaningful business impact if steps are reordered, skipped, repeated, or delegated.

Handoff Criteria

  • Hand off to pentest-web-application-logic-mapper when the workflow is not mapped well enough to test.
  • Hand off to pentest-input-protocol-manipulation when parser or payload behavior becomes the main blocker.
  • Hand off to pentest-exploit-execution-payload-control only after a deterministic business-logic primitive exists.

Output Schema

  • Workflow model: step, required controls, bypass hypothesis
  • Abuse sequence: ordered requests/events with timing notes
  • Impact proof: unauthorized state change and resulting capability

Instructions

  1. Model intended state transitions before adversarial testing.
  2. Identify assumptions in sequencing, concurrency, and cross-system coordination.
  3. Execute minimal abuse sequences that challenge those assumptions.
  4. Confirm impact through observable unauthorized state or action outcomes.
  5. Validate whether fixes require control relocation, not only input filtering.
  6. Hand off only confirmed primitives for exploit execution.

Verification Gate

  • Treat logic abuse as system-behavior testing, not payload-only testing.
  • Use time-aware evidence for race and replay cases.
  • Include reversible test design for stateful systems.
  • Report logic flaws only with demonstrated unauthorized effect.
  • Use controls for expected state, unauthorized state, and replay/race timing.
  • Keep concurrency low and stop when capability is proven.

Comments

Markdown supported