pentest-bizlogic

name	pentest-bizlogic
description	Business logic flaw hunting — price manipulation, race condition, workflow bypass, authorization edge case advisory. Triggers on business logic, bizlogic, race condition, price manipulation, workflow bypass, payment flaw, coupon abuse, refund abuse, time-of-check race.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-bizlogic","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents bizlogic-hunter"}

pentest-bizlogic

Advisory for business-logic vulnerabilities automated scans miss. Requires human analysis — this skill provides methodology + checklists.

Triggers

• "race condition test"
• "price manipulation"
• "workflow bypass"
• "coupon abuse"
• "refund flow vulnerability"
• "checkout flow analysis"

Common Bizlogic Categories

Category	Example	Test
Price manipulation	Change the cart price in the POST body	Negative price, decimal precision, currency mismatch
Race condition	5 parallel /api/redeem-coupon	Use the coupon 2x via a race
Workflow bypass	POST directly to step 3 (skip 1, 2)	State machine skipping
Coupon abuse	Single-use coupon across multiple accounts	No coupon scope
Refund abuse	Refund > original	No server-side total recalc
Account recovery	Username + date of birth -> reset link	Missing out-of-band factor
Voucher generation	Voucher code predictable (sequential)	Insufficient entropy
MFA bypass	login_step=2 POST directly -> token	Insecure server state
Privilege grant	User A invites User B -> B becomes admin	Role inheritance flaw

Race Condition Test Pattern

# 5 parallel requests — functional reuse test
for i in {1..5}; do
  curl -X POST https://<target>/api/redeem -H "Authorization: Bearer $TOKEN" \
       -d '{"coupon":"SAVE10"}' &
done
wait

# Expectation: 1 success + 4 errors
# Vulnerability: 5 successes -> coupon stacking via a race

More controlled: Turbo Intruder (Burp), Repeater Group "Send in parallel" (Burp Pro 2023+).

Price Manipulation Checklist

• Is the cart price client-side (change it in the POST body, does the server accept it)
• Currency code swap (USD -> EUR, server doesn't recalc the total)
• Decimal precision (price: 1.99 -> 1.99999, which version is saved)
• Negative quantity (qty: -1 -> negative invoice, credit issued)
• Discount > 100% (coupon 110% discount, payable negative)
• Promo + sale price (two discounts stacked, is it forbidden)

Workflow Bypass Checklist

Flow: signup -> verify email -> set password -> dashboard

Test:
- POST /set-password directly, can verify be skipped
- /dashboard directly, before /signup is completed
- /payment direct POST, /cart skip
- Is a signed token required from step 2 to step 4

Coupon Abuse Checklist

• Single-use coupon — used: true server-side after use
• Per-user limit — the same account is blocked from using it 5 times
• Race condition — 10 parallel redeems
• Coupon stack — multiple coupons on the same order
• Expired coupon — server-side time validation
• Coupon scope — is it valid only in the electronics category (does it apply to others)

Refund Flow

• Refund > original purchase (negative balance)
• Item is not returned after a refund (stock does not go to 0)
• Refund + chargeback simultaneous
• Refund tokenize: refund_id is predictable (sequential)

Methodology Flow

1. Understand the application logic (simulate user behavior)
2. Draw the state diagram (which state each endpoint changes)
3. List the state invariants (rules that are always true)
4. Break the invariants: out-of-order, parallel, negative, edge value
5. Log what the server-side does (response code, state check)
6. Reproduce the PoC + report immediately

Out-of-Scope

• Automated bizlogic scan (requires human analysis)
• Production data modification (a test environment is required)
• Extra transfer for personal gain (show proof, do not transfer)