# Business Logic Vulnerabilities

Business logic vulnerability playbook.

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Security
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill business-logic-vulnerabilities -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill business-logic-vulnerabilities -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill business-logic-vulnerabilities -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill business-logic-vulnerabilities -g -a gemini-cli -y`

## Description

Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: Business Logic Vulnerabilities, Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Business logic flaws are scanner-invisible and high-reward on bug bounty. This skill covers race conditions, price manipulation, workflow bypass, coupon/referral abuse, negative values, and state machine attacks. These require human reasoning, not automation. For specific exploitation techniques (payment precision/overflow, captcha bypass, password reset flaws, user enumeration), load the companion [SCENARIOS.md](./SCENARIOS.md). For the workflow approach itself (modeling → state machine → attack-surface matrix → human judgement) load [METHODOLOGY.md](./METHODOLOGY.md). For the per-module check items load [CHECKLIST.md](./CHECKLIST.md).

### Companion files

| File | When to load |
|---|---|
| [METHODOLOGY.md](./METHODOLOGY.md) | Need the 5-phase workflow, attack-surface 5×N matrix, human-judgement decision tree |
| [CHECKLIST.md](./CHECKLIST.md) | Going through a target module-by-module (login / register / payment / IDOR / privacy) and want every line item with why+verify |
| [SCENARIOS.md](./SCENARIOS.md) | Drilling deeper into payment precision/overflow, captcha bypass, password reset, enumeration, frontend bypass |

### Extended Scenarios

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/business-logic-vulnerabilities/SKILL.md