Business logic vuln
Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.From its SKILL.md
npx -y skills add ShulkwiSEC/bb-huge --skill business-logic-vulnAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.2 KB, 232 tokens by cl100k_base, as published. Nobody here has run it
Business Logic Router
This is the routing entry point for business-logic and state-machine issues.
When to Use
- The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions
- The issue is not parser-level; it is about when checks happen and which business conditions are checked
- You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws
Skill Map
Recommended Flow
- First map key business states and one-time actions
- Then check for check-then-act windows, sequence dependencies, or missing cross-step authorization
- If the chain depends on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path
Related Categories
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.