Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

pentest-business-logic-abuse

Estrellas2

Forks0

Actualizado3 de julio de 2026 a las 09:18

Business logic and workflow abuse assessment for state-machine manipulation, race conditions, replay, quota abuse, order-of-operations flaws, delegated execution abuse, and unauthorized state transitions. Hands off to recon, input/protocol, exploit, or reporting workflows when those become the owner phase.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

crtvrffnrt

crtvrffnrt/skills

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	pentest-business-logic-abuse
description	Business logic and workflow abuse assessment for state-machine manipulation, race conditions, replay, quota abuse, order-of-operations flaws, delegated execution abuse, and unauthorized state transitions. Hands off to recon, input/protocol, exploit, or reporting workflows when those become the owner phase.

Business Logic Abuse

Use When

The main question is workflow bypass, race condition, replay, quota abuse, confused deputy behavior, or unauthorized state transition.
A mapped workflow has meaningful business impact if steps are reordered, skipped, repeated, or delegated.

Handoff Criteria

Hand off to pentest-web-application-logic-mapper when the workflow is not mapped well enough to test.
Hand off to pentest-input-protocol-manipulation when parser or payload behavior becomes the main blocker.
Hand off to pentest-exploit-execution-payload-control only after a deterministic business-logic primitive exists.

Output Schema

Workflow model: step, required controls, bypass hypothesis
Abuse sequence: ordered requests/events with timing notes
Impact proof: unauthorized state change and resulting capability

Instructions

Model intended state transitions before adversarial testing.
Identify assumptions in sequencing, concurrency, and cross-system coordination.
Execute minimal abuse sequences that challenge those assumptions.
Confirm impact through observable unauthorized state or action outcomes.
Validate whether fixes require control relocation, not only input filtering.
Hand off only confirmed primitives for exploit execution.

Verification Gate

Treat logic abuse as system-behavior testing, not payload-only testing.
Use time-aware evidence for race and replay cases.
Include reversible test design for stateful systems.
Report logic flaws only with demonstrated unauthorized effect.
Use controls for expected state, unauthorized state, and replay/race timing.
Keep concurrency low and stop when capability is proven.

Más de este repositorio

mismo repositorio

pentest-shodan-helper

crtvrffnrt/skills

Shodan CLI-only search workflow for query design, filter selection, count/stats validation, and search-result retrieval through /root/.local/bin/shodan.

2026-07-082

pentest-cve-reverse-engineer

crtvrffnrt/skills

Manual vulnerability research skill for finding advisories, downloading affected and fixed artifacts, diffing patches, confirming root cause, and writing reliable reports across products and technologies.

2026-07-082

pentest-gemini-sub-htb

crtvrffnrt/skills

Controlled lab skill for Hack The Box, CTF, and private lab workflows from reconnaissance, enumeration, vulnerability research, exploitation, foothold, and privilege escalation through evidence consolidation.

2026-07-032

incident-response-fileanalyser

crtvrffnrt/skills

Static malware reverse-engineering and threat-intelligence triage for unknown files, Windows EXE/PE binaries, scripts, archives, ISOs, JavaScript, PowerShell, documents, and unpacked payloads. Use when a user provides a sample path, hash, filename, or file and asks whether it is malicious, benign, suspicious, contains IoCs, or should be reverse engineered with Ghidra, strings, capa, YARA, public TI, and structured phase artifacts.

2026-07-032

incident-response-bec

crtvrffnrt/skills

BEC and AiTM incident-response skill for suspicious sign-ins, mailbox abuse, forwarding, inbox rules, session theft, token replay, consent abuse, and secondary phishing.

2026-07-032

incident-response-main

crtvrffnrt/skills

Defensive incident-response companion for Microsoft Entra ID, Microsoft 365, Defender, and mixed identity or endpoint incidents. Use for sign-in triage, public-IP enrichment, initial scoping, containment planning, and analyst-ready notes.

2026-07-032

name	pentest-business-logic-abuse
description	Business logic and workflow abuse assessment for state-machine manipulation, race conditions, replay, quota abuse, order-of-operations flaws, delegated execution abuse, and unauthorized state transitions. Hands off to recon, input/protocol, exploit, or reporting workflows when those become the owner phase.

Business Logic Abuse

Use When

The main question is workflow bypass, race condition, replay, quota abuse, confused deputy behavior, or unauthorized state transition.
A mapped workflow has meaningful business impact if steps are reordered, skipped, repeated, or delegated.

Handoff Criteria

Hand off to pentest-web-application-logic-mapper when the workflow is not mapped well enough to test.
Hand off to pentest-input-protocol-manipulation when parser or payload behavior becomes the main blocker.
Hand off to pentest-exploit-execution-payload-control only after a deterministic business-logic primitive exists.

Output Schema

Workflow model: step, required controls, bypass hypothesis
Abuse sequence: ordered requests/events with timing notes
Impact proof: unauthorized state change and resulting capability

Instructions

Model intended state transitions before adversarial testing.
Identify assumptions in sequencing, concurrency, and cross-system coordination.
Execute minimal abuse sequences that challenge those assumptions.
Confirm impact through observable unauthorized state or action outcomes.
Validate whether fixes require control relocation, not only input filtering.
Hand off only confirmed primitives for exploit execution.

Verification Gate

Treat logic abuse as system-behavior testing, not payload-only testing.
Use time-aware evidence for race and replay cases.
Include reversible test design for stateful systems.
Report logic flaws only with demonstrated unauthorized effect.
Use controls for expected state, unauthorized state, and replay/race timing.
Keep concurrency low and stop when capability is proven.