web-vuln-business-logic

What this skill does

Detects business logic vulnerabilities by mapping application workflows, identifying state transitions, and testing each for skip/replay/manipulation attacks. Covers six categories: workflow step bypass, negative quantity and price manipulation, coupon and discount abuse, rate limit bypass via racing, feature flag abuse, and time-of-check-time-of-use (TOCTOU) race conditions. Uses manual testing with curl and Burp Suite — no specialized vulnerability scanner applies to this class.

When to use

• When testing any feature involving money, credits, discounts, or refunds
• When an application has a multi-step workflow (checkout, registration, password reset, subscription upgrade)
• When a request body contains a price, quantity, amount, or discount field
• When a coupon or promo code endpoint exists
• When a feature is gated behind a role, plan, or subscription level
• When testing actions that check a value and then act on it (balance checks, ownership checks, quota limits)

Prerequisites