pentest-bizlogic

name	pentest-bizlogic
description	Business logic flaw hunting — price manipulation, race condition, workflow bypass, authorization edge case advisory. Triggers on business logic, bizlogic, race condition, price manipulation, workflow bypass, payment flaw, coupon abuse, refund abuse, time-of-check race.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents bizlogic-hunter"}

pentest-bizlogic

Otomatik scan'in yakalayamadigi is mantigi zafiyetleri advisory. Insan analizi gerekir — bu skill methodology + checklist saglar.

Triggers

• "race condition test"
• "fiyat manipulasyonu"
• "workflow bypass"
• "coupon abuse"
• "refund flow zafiyet"
• "checkout flow analiz"

Yaygin Bizlogic Kategorileri

Kategori	Ornek	Test
Price manipulation	Cart'taki fiyati POST body'de degistir	Negative price, decimal precision, currency mismatch
Race condition	5 paralel /api/redeem-coupon	Race ile coupon 2x kullanim
Workflow bypass	Adim 3'e dogrudan POST (1,2 atla)	State machine atlama
Coupon abuse	Tek kullanimlik coupon birden cok hesapla	Coupon scope yok
Refund abuse	Refund > original	Server-side total recalc yok
Account recovery	Username + dogum tarihi -> reset link	Out-of-band factor eksik
Voucher generation	Voucher code predictable (sequential)	Insufficient entropy
MFA bypass	login_step=2 dogrudan post -> token	Server state guvensiz
Privilege grant	User A, User B'yi davet -> B admin olur	Role inheritance flaw

Race Condition Test Pattern

# 5 paralel request — fonksiyonel reuse testi
for i in {1..5}; do
  curl -X POST https://<hedef>/api/redeem -H "Authorization: Bearer $TOKEN" \
       -d '{"coupon":"SAVE10"}' &
done
wait

# Beklenti: 1 basari + 4 hata
# Zafiyet: 5 basari -> race ile coupon stack

Daha kontrollu: Turbo Intruder (Burp), Repeater Group "Send in parallel" (Burp Pro 2023+).

Price Manipulation Checklist

• Cart fiyati client-tarafli mi (POST body'de degistir, server kabul eder mi)
• Currency code swap (USD -> EUR, server total recalc yapmaz)
• Decimal precision (price: 1.99 -> 1.99999, hangi version saved)
• Negative quantity (qty: -1 -> negatif fatura, kredi acik)
• Discount > 100% (coupon 110% indirim, payable negatif)
• Promo + sale ucu (iki indirim stack, yasakli mi)

Workflow Bypass Checklist

Flow: signup -> verify email -> set password -> dashboard

Test:
- POST /set-password dogrudan, verify atlanir mi
- /dashboard dogrudan, /signup tamamlanmadan
- /payment direct POST, /cart skip
- Step 2'den step 4'e signed token gerekli mi

Coupon Abuse Checklist

• Tek kullanimlik coupon — kullanildiktan sonra used: true server-side
• Per-user limit — ayni hesap 5 kez kullanim engellenir
• Race condition — paralel 10 redeem
• Coupon stack — birden cok coupon ayni order'da
• Expired coupon — server saat dogrulamasi
• Coupon scope — sadece elektronik kategorisinde gecerli mi (digerine uygulanir mi)

Refund Flow

• Refund > original purchase (negative balance)
• Refund'dan sonra item iade edilmiyor (stock 0 olmaz)
• Refund + chargeback simultaneous
• Refund tokenize: refund_id tahmin edilebilir (sequential)

Methodology Akisi

1. Application logic'i anla (kullanici davranisi simulate et)
2. State diagram ciz (her endpoint hangi state'i degistirir)
3. State invariant'lari listele (her zaman dogru olan kurallar)
4. Invariant'lari kir: out-of-order, parallel, negative, edge value
5. Server-side ne yaptigini logla (response code, state check)
6. PoC reproduce et + acil rapor

Out-of-Scope

• Automated bizlogic scan (insan analizi gerekir)
• Production data modification (test ortami zorunlu)
• Sahsi kazanc icin ek transfer (kanit goster, transferi yapma)