web-app-logic

// Web application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure.

$ git log --oneline --stat
stars:273forks:50updated:May 15, 2026 at 16:48
SKILL.md
readonly
nameweb-app-logic
descriptionWeb application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure.

name: web-app-logic description: Web application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure.

Web Application Logic

Test for logic flaws and application-specific vulnerabilities that automated scanners miss.

Techniques

TypeKey Vectors
Business LogicWorkflow bypass, price manipulation, feature abuse
Race ConditionsTOCTOU, limit bypass, double-spend, parallel requests
Access ControlIDOR, horizontal/vertical privilege escalation, forced browsing
Cache PoisoningUnkeyed headers/parameters, fat GET, response splitting
Cache DeceptionPath confusion, static extension tricks, normalization
Info DisclosureError messages, debug endpoints, source code, metadata

Workflow

  1. Map application workflows and business rules
  2. Identify state-dependent operations and trust boundaries
  3. Test logic assumptions with edge cases and race conditions
  4. Verify access control across user roles
  5. Document impact with PoC demonstrations

Reference

  • reference/business-logic*.md - Business logic testing techniques
  • reference/race-conditions*.md - Race condition exploitation
  • reference/access-control*.md - Access control bypass methods
  • reference/web-cache-poisoning*.md - Cache poisoning techniques
  • reference/web-cache-deception*.md - Cache deception attacks
  • reference/information-disclosure*.md - Information disclosure testing