Business Logic Vulnerabilities

Exploitation HIGH v1.0.0 updated 2026-06-17

Test application workflows for logic flaws — race conditions, price manipulation, coupon abuse, workflow bypass, and state management issues.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/business-logic-testing

// checklist steps

logic-01

Map application workflows and state machines

Document every multi-step process in the application — registration, checkout, payment, approval workflows — and identify the expected state transitions.

# Capture and document all workflow endpoints
cat proxy-history.json | grep -oiE 'https://target.com/api/(checkout|cart|order|payment|transfer|approval|workflow)[^"]*' | sort -u
# Map state parameters
cat proxy-history.json | grep -oiE '"(status|state|step|stage|phase)":\s*"[^"]+"' | sort -u

Draw the expected state machine on paper before testing. Identify which transitions should be impossible — going from 'cancelled' back to 'active', or from 'pending' directly to 'completed' without payment.

logic-02

Test price and quantity manipulation

Modify price, quantity, discount, and total fields in API requests to test whether the server recalculates and validates these values independently.

# Modify price in checkout request
curl -sk -X POST 'https://target.com/api/checkout' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"item_id": "1001", "price": 0.01, "quantity": 1}'
# Negative quantity
curl -sk -X POST 'https://target.com/api/cart/add' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"item_id": "1001", "quantity": -1}'
# Modify total amount
curl -sk -X POST 'https://target.com/api/payment/process' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"order_id": "12345", "amount": 0.01}'

Always test from the final payment endpoint, not just the cart. Some applications validate prices in the cart but trust the client-submitted total at the payment stage.

logic-03

Test coupon and discount abuse

Test coupon code functionality for stacking, reuse, race conditions, and manipulation of discount percentages or fixed amounts.

# Apply same coupon multiple times
for i in $(seq 1 5); do curl -sk -X POST 'https://target.com/api/cart/coupon' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"code": "SAVE20"}'; done
# Stack multiple coupons
curl -sk -X POST 'https://target.com/api/cart/coupon' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"code": "SAVE20"}' && curl -sk -X POST 'https://target.com/api/cart/coupon' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"code": "WELCOME10"}'
# Modify discount value
curl -sk -X POST 'https://target.com/api/cart/coupon' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"code": "SAVE20", "discount": 100}'

Try applying coupons after the price has been calculated but before final payment. Test whether expired or already-used coupons are still accepted in race condition scenarios.

logic-04

Test workflow step bypass and reordering

Attempt to skip required steps in multi-step processes, access later steps directly, or reorder the sequence of operations.

# Skip verification step and go to completion
curl -sk -X POST 'https://target.com/api/account/verify-complete' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"verified": true}'
# Access final step without completing prerequisites
curl -sk -X POST 'https://target.com/api/order/finalize' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"order_id": "12345"}'
# Replay a previous step after completion
curl -sk -X POST 'https://target.com/api/order/apply-discount' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"order_id": "12345", "discount": "50"}'

Test each step in isolation by calling it directly without prior steps. Many applications check only whether the current step's input is valid, not whether the user completed the prerequisite steps.

logic-05

Test negative values and boundary conditions

Submit negative numbers, zero values, extreme integers, and floating-point edge cases to test input validation in financial and quantity calculations.

# Negative transfer amount
curl -sk -X POST 'https://target.com/api/transfer' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"to": "other_user", "amount": -100}'
# Integer overflow
curl -sk -X POST 'https://target.com/api/cart/add' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"item_id": "1001", "quantity": 2147483647}'
# Floating-point precision
curl -sk -X POST 'https://target.com/api/transfer' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"to": "other_user", "amount": 0.000000001}'

Negative values in financial transactions can reverse fund flows. Test whether a negative transfer from account A to account B actually moves money from B to A.

logic-06

Test race conditions in financial operations

Send concurrent requests to exploit time-of-check-to-time-of-use (TOCTOU) vulnerabilities in balance checks, stock verification, and one-time operations.

# Turbo Intruder race condition script (use in Burp Suite)
# Send 20 concurrent withdrawal requests
for i in $(seq 1 20); do curl -sk -X POST 'https://target.com/api/withdraw' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"amount": 100}' & done; wait
# Race condition on one-time coupon redemption
for i in $(seq 1 10); do curl -sk -X POST 'https://target.com/api/redeem' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"code": "ONETIME50"}' & done; wait

Use Turbo Intruder's single-packet attack for precise timing — HTTP/2 allows sending multiple requests in a single TCP packet, eliminating network jitter. Test with amounts that should exceed the available balance.

Overview

Business logic vulnerabilities are flaws in the application’s design and implementation of workflows rather than technical input validation failures. They cannot be detected by automated scanners and require manual analysis of how the application is supposed to behave versus how it actually behaves.

Testing philosophy

Logic testing starts with understanding the intended workflow. You cannot find a bypass if you do not know what the correct process looks like. Map every step, every state transition, and every assumption the developer made about user behaviour — then systematically violate each assumption.

Race conditions

Race conditions in financial operations represent some of the highest-impact logic vulnerabilities. Modern techniques like HTTP/2 single-packet attacks enable precise timing that makes exploitation reliable rather than probabilistic.

// references

← All checklists JSON ↗