Skip to content

06-business-logic.md

Latest commit

 

History

History
74 lines (51 loc) · 2.35 KB

06-business-logic.md

File metadata and controls

74 lines (51 loc) · 2.35 KB
Raw

06 — Business Logic

The bugs scanners can't find. Where pentesters earn their fee.

Patterns to test

Race conditions

Two requests sent simultaneously:

# Burp Repeater → group → send in parallel
# or:
turbo-intruder (Burp extension)

Common targets:

  • Coupon application (apply same coupon twice).
  • Balance transfer (transfer X twice when balance only allows once).
  • 2FA enable/disable (race the state change to bypass).
  • Account creation (race to claim same username).

Replay attacks

  • Old request sent again — does it succeed? (Idempotency).
  • Refresh-token reuse after rotation.
  • One-time tokens that aren't actually one-time.

Price manipulation

# normal request
POST /checkout {"item": "abc", "qty": 1, "price": 9.99}

# tampered
POST /checkout {"item": "abc", "qty": 1, "price": 0.01}
POST /checkout {"item": "abc", "qty": -1, "price": 9.99}     # negative qty
POST /checkout {"item": "abc", "qty": 1, "discount": 100}   # 100% discount

If the server trusts client-supplied price → finding.

Multi-step flow abuse

  • Skip a step (e.g., payment confirmation) by going directly to the final endpoint.
  • Modify earlier-step data after later step has consumed it.
  • Refresh / back-button to replay confirmations.

Mass actions

  • Send bulk request beyond user's quota (POST /api/messages?ids=1..1000).
  • Trigger expensive operations the API doesn't rate-limit.

Methodology

  1. Map the flow. Pen-and-paper or a Whimsical board. Every state transition and the user-facing intent.
  2. Identify trust boundaries. Each transition is "what does the server believe about the client's state?"
  3. Test the boundary. Skip transitions, replay them, run them simultaneously, supply impossible data.

Common findings

Bug Symptom
Negative quantity / price Refund-as-purchase
Coupon stacking Multiple coupons compound discounts
Currency confusion Send "USD" amount with "JPY" code (100x)
Weight-of-zero Order with 0 items but non-zero shipping refund
Off-by-one limits Spend exactly the budget = -$0.01 balance

What's hard about this work

You can't lint your way to business logic bugs. They require understanding the application's intent well enough to spot when its enforcement is sloppy.

Read the docs, talk to the developer, draw the flowchart. Then break it.