Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

pentest-business-logic-abuse

Étoiles2

Forks0

Mis à jour3 juillet 2026 à 09:18

Business logic and workflow abuse assessment for state-machine manipulation, race conditions, replay, quota abuse, order-of-operations flaws, delegated execution abuse, and unauthorized state transitions. Hands off to recon, input/protocol, exploit, or reporting workflows when those become the owner phase.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

crtvrffnrt

crtvrffnrt/skills

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

name	pentest-business-logic-abuse
description	Business logic and workflow abuse assessment for state-machine manipulation, race conditions, replay, quota abuse, order-of-operations flaws, delegated execution abuse, and unauthorized state transitions. Hands off to recon, input/protocol, exploit, or reporting workflows when those become the owner phase.

Business Logic Abuse

Use When

The main question is workflow bypass, race condition, replay, quota abuse, confused deputy behavior, or unauthorized state transition.
A mapped workflow has meaningful business impact if steps are reordered, skipped, repeated, or delegated.

Handoff Criteria

Hand off to pentest-web-application-logic-mapper when the workflow is not mapped well enough to test.
Hand off to pentest-input-protocol-manipulation when parser or payload behavior becomes the main blocker.
Hand off to pentest-exploit-execution-payload-control only after a deterministic business-logic primitive exists.

Output Schema

Workflow model: step, required controls, bypass hypothesis
Abuse sequence: ordered requests/events with timing notes
Impact proof: unauthorized state change and resulting capability

Instructions

Model intended state transitions before adversarial testing.
Identify assumptions in sequencing, concurrency, and cross-system coordination.
Execute minimal abuse sequences that challenge those assumptions.
Confirm impact through observable unauthorized state or action outcomes.
Validate whether fixes require control relocation, not only input filtering.
Hand off only confirmed primitives for exploit execution.

Verification Gate

Treat logic abuse as system-behavior testing, not payload-only testing.
Use time-aware evidence for race and replay cases.
Include reversible test design for stateful systems.
Report logic flaws only with demonstrated unauthorized effect.
Use controls for expected state, unauthorized state, and replay/race timing.
Keep concurrency low and stop when capability is proven.

Plus depuis ce dépôt

même dépôt

pentest-shodan-helper

crtvrffnrt/skills

Shodan CLI-only search workflow for query design, filter selection, count/stats validation, and search-result retrieval through /root/.local/bin/shodan.

2026-07-082

pentest-cve-reverse-engineer

crtvrffnrt/skills

Manual vulnerability research skill for finding advisories, downloading affected and fixed artifacts, diffing patches, confirming root cause, and writing reliable reports across products and technologies.

2026-07-082

pentest-gemini-sub-htb

crtvrffnrt/skills

Controlled lab skill for Hack The Box, CTF, and private lab workflows from reconnaissance, enumeration, vulnerability research, exploitation, foothold, and privilege escalation through evidence consolidation.

2026-07-032

incident-response-fileanalyser

crtvrffnrt/skills

Static malware reverse-engineering and threat-intelligence triage for unknown files, Windows EXE/PE binaries, scripts, archives, ISOs, JavaScript, PowerShell, documents, and unpacked payloads. Use when a user provides a sample path, hash, filename, or file and asks whether it is malicious, benign, suspicious, contains IoCs, or should be reverse engineered with Ghidra, strings, capa, YARA, public TI, and structured phase artifacts.

2026-07-032

incident-response-bec

crtvrffnrt/skills

BEC and AiTM incident-response skill for suspicious sign-ins, mailbox abuse, forwarding, inbox rules, session theft, token replay, consent abuse, and secondary phishing.

2026-07-032

incident-response-main

crtvrffnrt/skills

Defensive incident-response companion for Microsoft Entra ID, Microsoft 365, Defender, and mixed identity or endpoint incidents. Use for sign-in triage, public-IP enrichment, initial scoping, containment planning, and analyst-ready notes.

2026-07-032

name	pentest-business-logic-abuse
description	Business logic and workflow abuse assessment for state-machine manipulation, race conditions, replay, quota abuse, order-of-operations flaws, delegated execution abuse, and unauthorized state transitions. Hands off to recon, input/protocol, exploit, or reporting workflows when those become the owner phase.

Business Logic Abuse

Use When

The main question is workflow bypass, race condition, replay, quota abuse, confused deputy behavior, or unauthorized state transition.
A mapped workflow has meaningful business impact if steps are reordered, skipped, repeated, or delegated.

Handoff Criteria

Hand off to pentest-web-application-logic-mapper when the workflow is not mapped well enough to test.
Hand off to pentest-input-protocol-manipulation when parser or payload behavior becomes the main blocker.
Hand off to pentest-exploit-execution-payload-control only after a deterministic business-logic primitive exists.

Output Schema

Workflow model: step, required controls, bypass hypothesis
Abuse sequence: ordered requests/events with timing notes
Impact proof: unauthorized state change and resulting capability

Instructions

Model intended state transitions before adversarial testing.
Identify assumptions in sequencing, concurrency, and cross-system coordination.
Execute minimal abuse sequences that challenge those assumptions.
Confirm impact through observable unauthorized state or action outcomes.
Validate whether fixes require control relocation, not only input filtering.
Hand off only confirmed primitives for exploit execution.

Verification Gate

Treat logic abuse as system-behavior testing, not payload-only testing.
Use time-aware evidence for race and replay cases.
Include reversible test design for stateful systems.
Report logic flaws only with demonstrated unauthorized effect.
Use controls for expected state, unauthorized state, and replay/race timing.
Keep concurrency low and stop when capability is proven.