30건 · 관련도순
Identify and exploit flaws in the core business rules and logic of web applications. This skill focuses on manipulation of application workflows, pricing, inventory limitations, and multi-step processes. Use this skill when bug hunting or testing e-commerce, banking, or SaaS platforms where standard technical vulnerabilities (e.g., XSS/SQLi) are not present but the application's logic is flawed.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test application business rules by mapping workflows and checking unexpected actions, inputs, identities, and repetition. The skill helps investigate checkout, refunds, subscriptions, permissions, and concurrency flaws, then document reproduction steps and financial impact.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Investigate API requests that fail to replay because of client-generated signatures or anti-bot tokens. Start with captured traffic, identify the blocking inputs or signing function, and validate a reproducible request for further security testing.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Review checkout, discounts, subscriptions, and verification flows for business logic flaws. The skill helps connect price manipulation, repeated credit redemption, skipped checks, and forged payment notifications to measurable financial loss, unauthorized access, or privacy impact.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Strix 业务逻辑漏洞测试手册,覆盖流程绕过、状态操控与领域约束破坏;触发名:strix-business-logic
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Build a throwaway prototype to flesh out a design before committing to it. Routes between two branches — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route. Use when the user wants to prototype, sanity-check a data model or state machine, mock up a UI, explore design options, or says "prototype this", "let me play with it", "try a few designs".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Translate SQL queries into plain language business logic. Use when documenting queries, explaining analysis to non-technical stakeholders, code reviewing for correctness, or building a query catalog.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Perform black-box / grey-box web application penetration testing on an authorized target — auth bypass, IDOR, session handling, business-logic flaws, parameter tampering, Burp Suite / OWASP ZAP workflows. Use when the user mentions 'web pentest,' 'web application penetration test,' 'pentesting,' 'bug bounty,' 'Burp Suite,' 'ZAP,' 'OWASP testing,' 'authentication testing,' 'session testing,' 'authorization testing,' 'business logic testing,' 'web vulnerability testing,' or has explicit authorization to test a live web application.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Applies Functional Core, Imperative Shell to isolate logic from side effects. Use when business logic is entangled with I/O or unit tests are slow and brittle.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Business-logic flaw hunting - workflow/state bypass, price/quantity tampering, negative/overflow values, coupon/refund abuse, mass assignment, and logic races. The top-paying bug class with no scanner coverage. Wiki-first, FIND schema output.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
OSS-only security for OWASP Top 10, pentest, vuln testing (XSS, SSRF, CSRF, business-logic, Host header), threat modeling (STRIDE, ATT&CK), Sigma rules, SAST, code audit, AI/LLM red-team, or replacing paid tools (Burp, Nessus, Splunk) with OSS.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the diff changes a workflow with states, money, credits, quotas, approvals, invites, coupons, counters or expiry - skipped or replayed steps, check-then-act races with real impact, negative or overflowing quantities, partial-failure rollback, fail-open defaults, and legitimate features (export, import, search, preview, invite) used against their own rules
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Hunt business logic flaws — race conditions, workflow state bypass, parameter pollution affecting logic, coupon/discount abuse, refund logic, multi-step process bypass, integer overflow, negative quantities, double-spend. Use when looking for non-CVE bugs that require understanding the app's intended workflow.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit Time-of-Check to Time-of-Use (TOCTOU) race conditions in web applications and APIs. Use this skill when testing transactional operations (e.g., applying coupons, transferring funds, redeeming rewards, or purchasing items) to bypass business logic and duplicate actions before the server updates its database state.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Systematic fuzzing across two dimensions: (1) content discovery — hidden directories, files, backup/source leaks, HTTP verb enumeration, 401/403 bypass via path manipulation; (2) input validation — auth/token stripping, type confusion, boundary value analysis, HTTP parameter pollution, header fuzzing, cookie fuzzing, mass assignment discovery, and entropy/predictability analysis of any generated value. Works on any domain. Chains from /web-exploit or /pentester; chains into /business-logic when boundary violations, predictable IDs, or mass assignment are confirmed.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Business logic flaws are application vulnerabilities where valid functions are abused in unintended ways: price manipulation via hidden field tampering, workflow step-skipping, function call limit bypass (coupon reuse), process timing exploitation (race conditions on balance updates), and request forging via guessable/predictable parameters. Detect using Burp Suite proxy interception, HTTP POST/GET parameter analysis, and misuse-case testing against multi-step workflows. Tools: Burp Suite, OWASP ZAP.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects tests that validate framework/library behavior (Prisma, Express, bcrypt, JWT, axios, React hooks) instead of OUR code. Returns findings with REMOVE decisions.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Build a throwaway prototype to flesh out a design before committing to it. Routes between two branches — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route. Use when the user wants to prototype, sanity-check a data model or state machine, mock up a UI, explore design options, or says "prototype this", "let me play with it", "try a few designs".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.