Individual skill

business-logic-attack

Web 应用业务逻辑漏洞检测与利用。当目标有支付/交易/订单/优惠券/积分/余额/充值/转账/购物车等商业功能时使用。当发现用户注册/登录/短信验证码/邮箱验证/密码重置等账户功能时使用。当 API 请求中出现价格(price/amount)、数量(quantity/count)、订单号(order_id)、优惠码(coupon/promo)等业务参数时使用。业务逻辑漏洞不需要技术漏洞（SQLi/XSS），而是利用应用流程设计缺陷——负数金额、0元支付、订单状态篡改、验证码复用、并发竞争。SRC 众测和实战渗透中最高频的漏洞类型之一，每个有交易功能的应用都应检查

skills/exploit/web-method/business-logic-attack/SKILL.md

Source commit c0d3a4645f26be5b94f64344b501db4191dc9788

What was checked

Matches the observed repository HEAD

Yes

Scanner rules are current

Yes

Repository scan complete

No

Skill scan complete

Yes

Observed behavior

Network or broad shell

Last checked

Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.