domains / families / security / offensive-business-logic

offensive-business-logic

separate

Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact.

When to use

• workflow bypass
• state machine violations
• multi-step process abuse
• price/quantity/discount manipulation
• currency confusion
• coupon stacking
• refund/chargeback abuse
• race conditions on logic boundaries

When not to use

• surface-level OWASP Top 10 testing

Skill page

Source