Vapt Logic

Business Logic Testing

When Invoked

The user runs /vapt logic <url> or this skill is triggered as part of Wave 3 during /vapt audit.

Important Note

Business logic testing is inherently application-specific and mostly manual. This skill provides a structured methodology and specific test scenarios rather than automated scans. The tester must understand the application's business domain to execute these tests effectively.

Prerequisites

Check for existing context:

• If VAPT-WAVE2-CONTEXT.md exists -> use discovered functionality
• If other VAPT output files exist -> use to understand the application's features
• If no context -> crawl the application to identify key workflows

Phase 1: Application Profiling

1.1 Identify Business Functions

Crawl and analyze the application to identify:

• User registration / onboarding flow
• Authentication flows (login, password reset, MFA)
• E-commerce functions (cart, checkout, payment)
• Content management (create, edit, delete)
• Communication features (messaging, comments, sharing)
• Administrative functions
• Export / import features
• Search functionality
• File upload / download
• Subscription / billing

1.2 Map Multi-Step Workflows

For each workflow, document:

1. The expected sequence of steps
2. Required inputs at each step
3. Validation rules between steps
4. Expected outcomes

Phase 2: Workflow Bypass Testing

2.1 Step Skipping

For multi-step processes (checkout, registration, wizards):

# Instead of: Step 1 -> Step 2 -> Step 3 -> Complete
# Try: Step 1 -> Step 3 -> Complete (skip Step 2)
# Try: Directly access Complete step
curl -s -X POST <url>/api/checkout/complete -H "Authorization: Bearer <token>" \
    -d '{"order_id":"123"}'

2.2 Step Reordering

Can steps be performed out of order? Does the server validate state?

2.3 Scoring

Phase 3: Race Condition Testing

3.1 Time-of-Check-Time-of-Use (TOCTOU)

Send concurrent requests to test for race conditions:

# Send 10 concurrent requests to the same endpoint
for i in $(seq 1 10); do
    curl -s -X POST <url>/api/transfer \
        -H "Authorization: Bearer <token>" \
        -d '{"amount":100,"to":"other_user"}' &
done
wait

Common race condition targets:

• Money transfers / balance deductions
• Coupon / voucher redemption
• Vote / like systems
• Inventory / stock checks
• One-time actions (claim bonus, activate trial)

3.2 Scoring

Phase 4: Numeric & Boundary Testing

4.1 Price / Quantity Manipulation

# Negative quantity
curl -s -X POST <url>/api/cart/add -d '{"product_id":1,"quantity":-1}'

# Zero price
curl -s -X POST <url>/api/cart/add -d '{"product_id":1,"quantity":1,"price":0}'

# Extremely large quantity
curl -s -X POST <url>/api/cart/add -d '{"product_id":1,"quantity":99999999}'

# Decimal abuse
curl -s -X POST <url>/api/transfer -d '{"amount":0.001}'

# Integer overflow
curl -s -X POST <url>/api/cart/add -d '{"quantity":2147483647}'

4.2 Coupon / Discount Abuse

• Apply same coupon multiple times
• Apply multiple coupons that shouldn't stack
• Use expired coupons
• Tamper with discount percentage in request
• Apply coupon to items outside its scope

4.3 Scoring

Phase 5: Feature Abuse

5.1 Email / Notification Abuse

• Can the user trigger unlimited emails (password reset, notifications)?
• Can the user send notifications to arbitrary email addresses?
• Is there rate limiting on notification triggers?

5.2 Data Export Abuse

• Can users export more data than they should access?
• Is there rate limiting on export functions?
• Do exports include data of other users?

5.3 Search Abuse

• Can search be used for data enumeration?
• Are search results properly filtered by user permissions?
• Can wildcard or regex searches cause performance issues?

5.4 Scoring

Phase 6: File Upload Abuse

6.1 File Type Abuse

Test if upload validation can be bypassed:

• Double extension: file.php.jpg
• Null byte: file.php%00.jpg
• Content-Type mismatch: upload .php with image/jpeg Content-Type
• Polyglot files: valid image that's also valid PHP/HTML
• SVG with embedded scripts

6.2 File Size Abuse

• Upload extremely large files to test limits
• Check for decompression bombs (zip bomb, gzip bomb)

6.3 Scoring

Phase 7: Idempotency Testing

7.1 Duplicate Actions

Submit the same action multiple times rapidly:

• Create the same resource twice
• Submit the same payment twice
• Perform the same state transition twice

Check if the application properly handles duplicate requests.

7.2 Scoring

Phase 8: Output

Terminal Output

Dev mode: Explain each business logic category, provide real-world case studies, explain why automated scanners miss these.

Pro mode: Test results table only.

VAPT-LOGIC.md

# VAPT Business Logic Testing Report

## Target: <url>
## Date: <timestamp>

## Application Profile
<identified business functions and workflows>

## Workflow Bypass
<step skipping and reordering results>

## Race Conditions
<concurrent request test results>

## Numeric / Boundary
<price, quantity, integer manipulation results>

## Feature Abuse
<email, export, search abuse results>

## File Upload
<upload restriction bypass results>

## Idempotency
<duplicate action results>

## Findings
<scored findings table>

## Suggested Next Steps
- /vapt report <url> -- compile full report

Cross-Skill Integration

• Business logic findings weight 5% in Security Posture Score
• Logic flaws often combine with injection or authz findings to create higher-impact chains
• Race condition findings may affect vapt-auth (session/token races)