Individual skill
business-logic
Business logic / authentication bypass / privilege escalation — POST body field tampering (role/is_admin/user_type), 2FA bypass via response manipulation, predictable TOTP seeds, hidden authorization headers, multi-step workflow tampering. For challenges tagged business_logic, privilege_escalation, 2fa_bypass, or auth_bypass that aren't pure IDOR/JWT.
packages/decepticon/decepticon/skills/standard/exploit/web/business-logic/SKILL.md
Source commit df879550544d36b6b1e69062f05adae28537adf2
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 8, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 6,567
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent Repository topic
- ai Repository topic
- cybersecurity Repository topic
- hacking Repository topic
- langchain Repository topic
- langgraph Repository topic
- llm Repository topic
- generative-ai Repository topic
- pentesting Repository topic
- pentest Repository topic
- operations Derived category
- security Derived category
Declared tags are partial or unavailable.
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Business Logic / Privilege Escalation
For challenges where the vulnerability is in the application's business rules, not in standard injection sinks. Common patterns: client-controlled privilege fields, 2FA bypass, predictable codes, hidden auth headers.
## 1. POST-Body Privilege Field Tampering
When registration/profile endpoints accept arbitrary JSON or form fields, the server may read trusted privilege flags from the request:
```bash
# Intercept normal registration first to see what fields are sent
curl -s -X POST 'https://<TARGET>/register' \
-H 'Content-Type: application/json' \
[Credential-related source omitted]
head -50 /tmp/register_baseline.txt