Skip to content
Get packs

Business Logic Attack Testing

Guides an agent through testing web, mobile and API apps for business logic flaws like price, coupon and refund abuse

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a structured methodology for finding business logic flaws, meaning cases where an app's rules (pricing, checkout steps, refunds, coupons, roles) can be bypassed even though no standard code bug exists. Once installed, the agent maps multi-step flows as state machines, then suggests specific probes such as skipping payment steps, sending negative quantities, swapping currencies, stacking coupons or replaying refunds. It is written for security professionals running authorised penetration tests or bug bounty work, and its examples are curl and HTTP request snippets.

Great for

  • Security testers on an authorised engagement against e-commerce, fintech, marketplace or SaaS apps
  • Bug bounty hunters who have already covered the OWASP Top 10 and want to look at logic flaws
  • Developers reviewing their own payment and checkout flows before release

Skip it if

  • Testing any app you do not have written permission to test, since the techniques are attacks against live systems and may be illegal without authorisation
  • Beginners expecting a click-through scanner; the skill is a methodology and the agent still needs to reason about each target

Try asking

  • “Map the checkout flow of this staging app as a state machine and list transitions I should probe for skipped steps”
  • “Given this API spec, suggest business logic tests for coupon stacking and negative quantities”
  • “Review this refund endpoint for missing idempotency or per-item refund calculation errors”
Step-by-step guide: how to use Business Logic Attack TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-business-logic.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-business-logic.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-business-logic.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only point the agent at systems you own or have written authorisation to test, and state the scope in your prompt
  • Give the agent the API spec, route list or request captures so its suggestions match the real application rather than generic examples
  • Ask for financial impact estimates per finding, as the skill recommends, to prioritise results for reporting

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.