Skill282 estrellas del repoactualizado yesterday

pentest-business-logic

The pentest-business-logic skill systematically tests for workflow bypass, payment manipulation, state machine abuse, and function limit circumvention flaws in applications. Use this when authorized to identify business logic vulnerabilities that escape standard taint analysis, such as step skipping in multi-step processes, coupon reuse exploits, price manipulation during checkout, and role-based constraint violations across OWASP WSTG business logic categories.

Ver fuente Repositorio: JoySafeter

Instalar en Claude Code

Copiar

git clone --depth 1 https://github.com/jd-opensource/JoySafeter /tmp/pentest-business-logic && cp -r /tmp/pentest-business-logic/skills/pentest-business-logic ~/.claude/skills/pentest-business-logic

Después abre una sesión nueva de Claude Code; el skill carga automáticamente.

Definición

SKILL.md

# Pentest Business Logic

## Purpose
Identify flaws in application workflow enforcement, business rule validation, and state machine integrity that cannot be found by taint analysis or pattern matching. These vulnerabilities require understanding intended behavior and finding deviations.

## Prerequisites

### Authorization Requirements
- **Written authorization** with explicit scope for business logic testing
- **Test accounts** at multiple privilege levels (user, admin, premium, etc.)
- **Test payment methods** or sandbox payment environment for financial testing
- **Rollback plan** for any data-mutating tests (order creation, account changes)

### Environment Setup
- Burp Suite Professional with Repeater/Intruder configured
- Playwright or Selenium for multi-step browser automation
- Proxy configured to capture all application traffic
- Test data seeded for workflow testing (products, coupons, user accounts)

## Core Workflow
1. **Workflow Mapping**: Extract multi-step flows (checkout, registration, approval chains, onboarding) from recon deliverables and source code. Document expected state transitions and business constraints.
2. **Rule Extraction**: Identify server-side business constraints — price validation, quantity limits, role-gated actions, time-based restrictions, coupon rules, referral limits.
3. **Step Circumvention**: Skip, replay, reorder steps in multi-step workflows. Access final-step endpoints directly without completing prerequisites (WSTG-BUSL-06).
4. **Data Integrity Abuse**: Submit negative quantities, zero-price items, boundary values, type confusion in business fields. Test forged request parameters (WSTG-BUSL-02/03).
5. **Function Limit Bypass**: Test coupon reuse, referral loops, vote stuffing, resource exhaustion through legitimate endpoints (WSTG-BUSL-05).
6. **File Upload Logic**: Upload unexpected file types, oversized files, polyglot files, content-type mismatch, path traversal in filenames (WSTG-BUSL-08/09).
7. **Payment Testing**: Price manipulation at each checkout stage, currency confusion, discount stacking, partial payment abuse (WSTG-BUSL-10).

## WSTG Coverage

| WSTG ID | Test Name | Status |
|---------|-----------|--------|
| WSTG-BUSL-01 | Test Business Logic Data Validation | ✅ |
| WSTG-BUSL-02 | Test Ability to Forge Requests | ✅ |
| WSTG-BUSL-03 | Test Integrity Checks | ✅ |
| WSTG-BUSL-04 | Test for Process Timing | ✅ |
| WSTG-BUSL-05 | Test Number of Times a Function Can Be Used Limits | ✅ |
| WSTG-BUSL-06 | Testing for the Circumvention of Work Flows | ✅ |
| WSTG-BUSL-07 | Test Defenses Against Application Misuse | ✅ |
| WSTG-BUSL-08 | Test Upload of Unexpected File Types | ✅ |
| WSTG-BUSL-09 | Test Upload of Malicious Files | ✅ |
| WSTG-BUSL-10 | Test Payment Functionality | ✅ |

## Tool Categories

| Category | Tools | Purpose |
|----------|-------|---------|
| Request Manipulation | Burp Repeater, Burp Intruder, mitmproxy | Modify request parameters, replay/reorder steps |
| Browser Automation | Playwright, Selenium | Multi-step workflow testing, UI interaction |
| Scripting | Python requests, aiohttp | Custom workflow abuse scripts, parallel requests |
| File Upload | custom polyglot generators, ExifTool | File type confusion, metadata injection |
| Payment Testing | Stripe test mode, PayPal sandbox | Safe payment manipulation testing |

## References
- `references/tools.md` - Tool function signatures and parameters
- `references/workflows.md` - Attack pattern definitions and test vectors

Del mismo repositorio

appSkill

brainstormingSkill

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

executing-plansSkill

Use when you have a written implementation plan to execute in a separate session with review checkpoints

openclaw-security-checkerSkill

OpenClaw 安全检测工具，基于安全实践指南验证配置安全、权限隔离、网络策略、日志审计和运行时完整性

openclaw-threat-detectSkill

OpenClaw 攻击模式检测工具，识别数据外传、反弹Shell、文件泄露、Prompt注入、供应链投毒等高危行为，支持 MITRE ATT&CK 映射

pdfSkill

Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. When Claude needs to fill in a PDF form or programmatically process, generate, or analyze PDF documents at scale.

pentest-ai-llm-securitySkill

AI/LLM application security testing — prompt injection, jailbreaking, data exfiltration, and insecure output handling per OWASP LLM Top 10.

pentest-api-deepSkill

Deep OWASP API Security Top 10 testing for REST, GraphQL, gRPC, and WebSocket APIs — BFLA, mass assignment, rate limiting, and unsafe consumption.