---
name: pentest-bizlogic-ddd5bdb2f2a3
description: Business logic flaw hunting — price manipulation, race condition, workflow bypass, authorization edge case advisory. Triggers on business logic, bizlogic, race condition, price manipulation, workflow bypass, payment flaw, coupon abuse, refund abuse, time-of-check race.
license: MIT
compatibility: Works with Claude Code
allowed-tools: Read Write Edit Bash Grep
metadata:
  author: badi
  badi-version: ">=1.24.0"
  category: pentest
  scope: advisory
  inspired-by: 0xSteph/pentest-ai-agents bizlogic-hunter
---

# pentest-bizlogic

Otomatik scan'in yakalayamadigi **is mantigi zafiyetleri** advisory. Insan analizi gerekir — bu skill methodology + checklist saglar.

## Triggers

- "race condition test"
- "fiyat manipulasyonu"
- "workflow bypass"
- "coupon abuse"
- "refund flow zafiyet"
- "checkout flow analiz"

## Yaygin Bizlogic Kategorileri

| Kategori | Ornek | Test |
|----------|-------|------|
| Price manipulation | Cart'taki fiyati POST body'de degistir | Negative price, decimal precision, currency mismatch |
| Race condition | 5 paralel /api/redeem-coupon | Race ile coupon 2x kullanim |
| Workflow bypass | Adim 3'e dogrudan POST (1,2 atla) | State machine atlama |
| Coupon abuse | Tek kullanimlik coupon birden cok hesapla | Coupon scope yok |
| Refund abuse | Refund > original | Server-side total recalc yok |
| Account recovery | Username + dogum tarihi -> reset link | Out-of-band factor eksik |
| Voucher generation | Voucher code predictable (sequential) | Insufficient entropy |
| MFA bypass | login_step=2 dogrudan post -> token | Server state guvensiz |
| Privilege grant | User A, User B'yi davet -> B admin olur | Role inheritance flaw |

## Race Condition Test Pattern

```bash
# 5 paralel request — fonksiyonel reuse testi
for i in {1..5}; do
  curl -X POST https://<hedef>/api/redeem -H "Authorization: Bearer $TOKEN" \
       -d '{"coupon":"SAVE10"}' &
done
wait

# Beklenti: 1 basari + 4 hata
# Zafiyet: 5 basari -> race ile coupon stack
```

Daha kontrollu: **Turbo Intruder** (Burp), **Repeater Group "Send in parallel"** (Burp Pro 2023+).

## Price Manipulation Checklist

- [ ] Cart fiyati client-tarafli mi (POST body'de degistir, server kabul eder mi)
- [ ] Currency code swap (USD -> EUR, server total recalc yapmaz)
- [ ] Decimal precision (price: 1.99 -> 1.99999, hangi version saved)
- [ ] Negative quantity (qty: -1 -> negatif fatura, kredi acik)
- [ ] Discount > 100% (coupon 110% indirim, payable negatif)
- [ ] Promo + sale ucu (iki indirim stack, yasakli mi)

## Workflow Bypass Checklist

```
Flow: signup -> verify email -> set password -> dashboard

Test:
- POST /set-password dogrudan, verify atlanir mi
- /dashboard dogrudan, /signup tamamlanmadan
- /payment direct POST, /cart skip
- Step 2'den step 4'e signed token gerekli mi
```

## Coupon Abuse Checklist

- [ ] Tek kullanimlik coupon — kullanildiktan sonra `used: true` server-side
- [ ] Per-user limit — ayni hesap 5 kez kullanim engellenir
- [ ] Race condition — paralel 10 redeem
- [ ] Coupon stack — birden cok coupon ayni order'da
- [ ] Expired coupon — server saat dogrulamasi
- [ ] Coupon scope — sadece elektronik kategorisinde gecerli mi (digerine uygulanir mi)

## Refund Flow

- [ ] Refund > original purchase (negative balance)
- [ ] Refund'dan sonra item iade edilmiyor (stock 0 olmaz)
- [ ] Refund + chargeback simultaneous
- [ ] Refund tokenize: refund_id tahmin edilebilir (sequential)

## Methodology Akisi

```
1. Application logic'i anla (kullanici davranisi simulate et)
2. State diagram ciz (her endpoint hangi state'i degistirir)
3. State invariant'lari listele (her zaman dogru olan kurallar)
4. Invariant'lari kir: out-of-order, parallel, negative, edge value
5. Server-side ne yaptigini logla (response code, state check)
6. PoC reproduce et + acil rapor
```

## Out-of-Scope

- Automated bizlogic scan (insan analizi gerekir)
- Production data modification (test ortami zorunlu)
- Sahsi kazanc icin ek transfer (kanit goster, transferi yapma)


---
Source attribution: badi
Original project: https://github.com/aibot88/sec_skill_store/blob/608120788167d56f99e31449e411e603ed250dc6/skills/claudskills/pentest-bizlogic/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: badi
Original project: https://github.com/aibot88/sec_skill_store/blob/608120788167d56f99e31449e411e603ed250dc6/skills/claudskills/pentest-bizlogic/SKILL.md
Attribution basis: Source repository record

Fields of work: Development & Engineering
Roles: Security Engineer, QA / Test Engineer, Backend Developer
Specialties: Specialty not specified
Tools: Bash, Grep
Country applicability: Country not specified
Classification basis: Source category, role and specialization labels
Instruction SHA-256: 3f3fb1ec7d069e9698ea32fe2a643824d5f8085ba9688449cbb122b020b1bae9