offensive-business-logic
针对高价值且难以自动检测的业务流程弱点提供实战思路。
包含可被用于未授权滥用的攻击方法和绕过技巧，请仅用于授权测试。
面向 Web/移动/API 的业务逻辑漏洞识别与攻击测试要点清单。
专门找应用里的业务逻辑漏洞，比如多步流程绕过、价格/折扣操控、租户或权限边界越界、退款/优惠滥用和竞态等。适合电商、金融、SaaS 等交易密集型场景，强调把每个流程当状态机梳理，发现会直接造成经济损失的使用场景。
▸ 展开 SKILL.md 英文原文
Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact.
帮我安装这个 skill：https://raw.githubusercontent.com/SnailSploit/Claude-Red/main/Skills/web/offensive-business-logic/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/SnailSploit/Claude-Red/main/Skills/web/offensive-business-logic/SKILL.md"# Business Logic — Offensive Testing Methodology Business logic flaws are the highest-paying class of vulnerability for bug bounty and the hardest for scanners to detect. They live in the gap between what the developer specified and what an attacker can convince the system to accept. ## Quick Workflow 1. Map every multi-step flow as a state machine (states + allowed transitions + side effects) 2. For each transition, ask: who can call it, in what state, with what inputs, how many times 3. Probe each axis (state, identity, input, frequency) for assumptions 4. Combine flaws — single-axis flaws are usually low severity; chains are critical 5. Quantify financial impact per finding (loss-per-a