mcpField
W
web-app-logic

web-app-logic

github.com/transilienceaiSecurity598206 installsUpdated 13w ago
Repository

About web-app-logic

A security skill for testing web application logic flaws that automated scanners may miss. It guides security testers through workflow, race-condition, access-control, cache, and information-disclosure checks, ending with documented proof of concept and impact.

Key features

  1. 01Business logic flaw testing
  2. 02Race-condition testing
  3. 03Access-control checks
  4. 04Cache attack testing
  5. 05Information-disclosure testing
  6. 06PoC impact documentation

Use cases

  1. 01Testing workflow and pricing rules
  2. 02Checking parallel requests for limit bypass
  3. 03Verifying permissions across user roles
  4. 04Documenting application-specific vulnerabilities

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/transilienceai/communitytools --skill web-app-logic

After installing, type/web-app-logicin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

reference/
access-control-resources.md
business-logic-resources.md
INDEX.md
information-disclosure-resources.md
race-conditions-resources.md
reference/scenarios/access-control/
data-leakage-redirect.md
header-bypass.md
idor-action.md
idor-read.md
mass-assignment.md
method-bypass.md
multi-step-bypass.md
parameter-based-controls.md
referer-bypass.md
unprotected-functionality.md
reference/scenarios/business-logic/
burp-extension-scanner.md
coupon-stacking.md
csrf-and-session-bypass.md
email-domain-bypass.md
gift-card-loop.md
parameter-pollution.md
price-manipulation.md
quantity-manipulation.md
regex-input-validation-bypass.md
workflow-bypass.md
reference/scenarios/cache/
deception-delimiter.md
deception-normalization.md
deception-path-mapping.md
deception-via-smuggling.md
poisoning-body-args.md

Details

From the project README

Web Application Logic

Test for logic flaws and application-specific vulnerabilities that automated scanners miss.

Techniques

TypeKey Vectors
Business LogicWorkflow bypass, price manipulation, feature abuse
Race ConditionsTOCTOU, limit bypass, double-spend, parallel requests
Access ControlIDOR, horizontal/vertical privilege escalation, forced browsing
Cache PoisoningUnkeyed headers/parameters, fat GET, response splitting
Cache DeceptionPath confusion, static extension tricks, normalization
Info DisclosureError messages, debug endpoints, source code, metadata

Workflow

  1. Map application workflows and business rules
  2. Identify state-dependent operations and trust boundaries
  3. Test logic assumptions with edge cases and race conditions
  4. Verify access control across user roles
  5. Document impact with PoC demonstrations

Reference

  • reference/business-logic*.md - Business logic testing techniques
  • reference/race-conditions*.md - Race condition exploitation
  • reference/access-control*.md - Access control bypass methods
  • reference/web-cache-poisoning*.md - Cache poisoning techniques
  • reference/web-cache-deception*.md - Cache deception attacks
  • reference/information-disclosure*.md - Information disclosure testing

Comments

Markdown supported