business-logic-vuln

A lightweight routing entry point for business-logic and state-machine security testing, positioned as a P1 category router rather than a full technique guide. Its job is to recognize when a target's real weakness lies in how a workflow behaves - when checks happen and which business conditions are actually verified - rather than in parser-level input injection, and to direct testing toward the right detailed skill.

It applies to flows built around coupons, inventory, payments, approvals, quotas, invites, trials, and state transitions, and to the classes of abuse that live there: race conditions, workflow bypass, price tampering, negative values, stacked discounts, and multi-step state attacks. When those concerns outweigh injection-style bugs, this router is the intended starting place. It hands off to a dedicated Business Logic Vulnerabilities skill for the in-depth methodology and sits alongside related category routers for API security, authentication, and file-access issues, which it links so a tester can move between attack surfaces as a chain demands.

The recommended flow is deliberately high level: first map the key business states and one-time actions in the target; then look for check-then-act windows, sequence dependencies, and missing cross-step authorization; and if the chain turns out to depend on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path. Because it is a router, it does not itself contain exploitation payloads or step-by-step attack recipes - its value is orientation, helping structure an assessment and ensuring workflow-level flaws are approached as a distinct problem from input-level ones before diving into the specialized skills that carry the concrete techniques.