jd-opensource/pentest-business-logic
skills/pentest-business-logic/SKILL.md
Business logic vulnerability testing — workflow bypass, payment manipulation, state machine abuse, and function limit circumvention per WSTG-BUSL.
$ install --global
skillsauthnpx skillsauth add jd-opensource/joysafeter pentest-business-logicInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 6, 2026, 2:18 AM5.4s3 files scanned
SKILL.md
- name:
- pentest-business-logic
- description:
- Business logic vulnerability testing — workflow bypass, payment manipulation, state machine abuse, and function limit circumvention per WSTG-BUSL.
Pentest Business Logic
Purpose
Identify flaws in application workflow enforcement, business rule validation, and state machine integrity that cannot be found by taint analysis or pattern matching. These vulnerabilities require understanding intended behavior and finding deviations.
Prerequisites
Authorization Requirements
- Written authorization with explicit scope for business logic testing
- Test accounts at multiple privilege levels (user, admin, premium, etc.)
- Test payment methods or sandbox payment environment for financial testing
- Rollback plan for any data-mutating tests (order creation, account changes)
Environment Setup
- Burp Suite Professional with Repeater/Intruder configured
- Playwright or Selenium for multi-step browser automation
- Proxy configured to capture all application traffic
- Test data seeded for workflow testing (products, coupons, user accounts)
Core Workflow
- Workflow Mapping: Extract multi-step flows (checkout, registration, approval chains, onboarding) from recon deliverables and source code. Document expected state transitions and business constraints.
- Rule Extraction: Identify server-side business constraints — price validation, quantity limits, role-gated actions, time-based restrictions, coupon rules, referral limits.
- Step Circumvention: Skip, replay, reorder steps in multi-step workflows. Access final-step endpoints directly without completing prerequisites (WSTG-BUSL-06).
- Data Integrity Abuse: Submit negative quantities, zero-price items, boundary values, type confusion in business fields. Test forged request parameters (WSTG-BUSL-02/03).
- Function Limit Bypass: Test coupon reuse, referral loops, vote stuffing, resource exhaustion through legitimate endpoints (WSTG-BUSL-05).
- File Upload Logic: Upload unexpected file types, oversized files, polyglot files, content-type mismatch, path traversal in filenames (WSTG-BUSL-08/09).
- Payment Testing: Price manipulation at each checkout stage, currency confusion, discount stacking, partial payment abuse (WSTG-BUSL-10).
WSTG Coverage
| WSTG ID | Test Name | Status | |---------|-----------|--------| | WSTG-BUSL-01 | Test Business Logic Data Validation | ✅ | | WSTG-BUSL-02 | Test Ability to Forge Requests | ✅ | | WSTG-BUSL-03 | Test Integrity Checks | ✅ | | WSTG-BUSL-04 | Test for Process Timing | ✅ | | WSTG-BUSL-05 | Test Number of Times a Function Can Be Used Limits | ✅ | | WSTG-BUSL-06 | Testing for the Circumvention of Work Flows | ✅ | | WSTG-BUSL-07 | Test Defenses Against Application Misuse | ✅ | | WSTG-BUSL-08 | Test Upload of Unexpected File Types | ✅ | | WSTG-BUSL-09 | Test Upload of Malicious Files | ✅ | | WSTG-BUSL-10 | Test Payment Functionality | ✅ |
Tool Categories
| Category | Tools | Purpose | |----------|-------|---------| | Request Manipulation | Burp Repeater, Burp Intruder, mitmproxy | Modify request parameters, replay/reorder steps | | Browser Automation | Playwright, Selenium | Multi-step workflow testing, UI interaction | | Scripting | Python requests, aiohttp | Custom workflow abuse scripts, parallel requests | | File Upload | custom polyglot generators, ExifTool | File type confusion, metadata injection | | Payment Testing | Stripe test mode, PayPal sandbox | Safe payment manipulation testing |
References
references/tools.md- Tool function signatures and parametersreferences/workflows.md- Attack pattern definitions and test vectors
Related Skills
jd-opensource/xlsx
development
VerifiedTrustedCommunity
Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work with spreadsheets (.xlsx, .xlsm, .csv, .tsv, etc) for: (1) Creating new spreadsheets with formulas and formatting, (2) Reading or analyzing data, (3) Modify existing spreadsheets while preserving formulas, (4) Data analysis and visualization in spreadsheets, or (5) Recalculating formulas
238SKILL.mdUpdated Apr 6, 2026
jd-opensource/writing-plans
development
VerifiedTrustedCommunity
Use when you have a spec or requirements for a multi-step task, before touching code
238SKILL.mdUpdated Apr 6, 2026
jd-opensource/skill-security-auditor
testing
VerifiedTrustedCommunity
OpenClaw Skills 全方位安全审计工具，检测供应链投毒、Prompt注入、恶意代码模式、权限越权和依赖风险
238SKILL.mdUpdated Apr 6, 2026
jd-opensource/skill-creator
tools
VerifiedTrustedCommunity
Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends an agent's capabilities with specialized knowledge, workflows, or tool integrations.
238SKILL.mdUpdated Apr 6, 2026