yaklang/hack-skills

business-logic-vuln

- Entry P1 category router for business logic testing.

Ver código-fonte
Documento original do Skill

Renderizado do repositório de origem, preservando títulos, exemplos, código, tabelas, links e imagens.

Business Logic Router

This is the routing entry point for business-logic and state-machine issues.

When to Use

  • The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions
  • The issue is not parser-level; it is about when checks happen and which business conditions are checked
  • You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws

Skill Map

Recommended Flow

  1. First map key business states and one-time actions
  2. Then check for check-then-act windows, sequence dependencies, or missing cross-step authorization
  3. If the chain depends on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path

Related Categories

do mesmo repositório

Mais Skills

Todos os Skills
yaklang
Comunidade

code-obfuscation-deobfuscation

- Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.

instalações
2
GitHub Stars
2,4 mil
Atualizado
13 de set.
yaklang
Comunidade

hack

- Entry P0 primary router and operating doctrine for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, authorized pentest, code audit, source-leak mining, middleware audit, SOC triage, detection engineering, incident response, or choosing the right next category skill before any deep topic skill. Also use when the user mentions 安全工程师, 渗透测试, 红队, 蓝队, 代码审计, 源码泄露, SRC. Enforce impact-first testing, finish the

instalações
2
GitHub Stars
2,4 mil
Atualizado
13 de set.
yaklang
Comunidade

steganography-techniques

- Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots, appended data, ADS), and text (whitespace, zero-width, homoglyphs) for hidden data.

instalações
2
GitHub Stars
2,4 mil
Atualizado
13 de set.
yaklang
Comunidade

401-403-bypass-techniques

- 401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

instalações
2
GitHub Stars
2,4 mil
Atualizado
13 de set.