Business-logic flaws
When it applies
The app works "correctly" per code but the rules can be gamed: paying less, getting more,
skipping a required step, or crossing a boundary the designers assumed users would respect.
Why it works
Scanners can't find these — they require understanding intent. Servers trust client-supplied
economics/state and assume the happy path; deviate from it and constraints (price, quantity,
sequence, ownership) aren't re-enforced.
Method
- Model the intended flow and its invariants (what must stay true: price ≥ 0, step order,
one coupon, my-cart-only).
- Break each invariant:
- Value tampering: negative/zero/huge quantity or price, currency/decimal tricks, integer overflow.
- Coupon/refund abuse: reuse, stack, apply after total, refund more than paid.
- Step skipping / state: jump to the confirmation/paid step, replay a step, reorder.
- Quota/limit bypass: race the check (→
web-race-conditions), reset counters, parallel requests.
- Boundary crossing: act on another tenant's resource (→
web-idor), escalate role via workflow.
- Quantify impact in business terms (free goods, money, privilege) for the report.
Gotchas
- These are context-specific — read the app like a user trying to cheat, not a scanner.
- Prove real impact (an order placed for $0, a limit bypassed), not just an odd response.
- Often chains with IDOR/race/mass-assignment — combine primitives.
Verify success
A completed abuse of the workflow with concrete gain (paid less/nothing, exceeded a limit,
accessed disallowed state) reproduced step-by-step.
References
PortSwigger business-logic labs; OWASP WSTG business-logic testing.
1---2name: web-business-logic3description: Find business-logic flaws — abusing intended functionality in unintended ways. Load on workflows with money/quantity/state/limits: checkout, coupons, refunds, transfers, quotas, multi-step flows, role/tenant boundaries. Signals: price/qty params, discount codes, step skipping, negative/overflow values.4---56# Business-logic flaws78## When it applies9The app works "correctly" per code but the *rules* can be gamed: paying less, getting more,10skipping a required step, or crossing a boundary the designers assumed users would respect.1112## Why it works13Scanners can't find these — they require understanding intent. Servers trust client-supplied14economics/state and assume the happy path; deviate from it and constraints (price, quantity,15sequence, ownership) aren't re-enforced.1617## Method181. **Model the intended flow** and its invariants (what must stay true: price ≥ 0, step order,19 one coupon, my-cart-only).202. **Break each invariant**:21 - **Value tampering**: negative/zero/huge quantity or price, currency/decimal tricks, integer overflow.22 - **Coupon/refund abuse**: reuse, stack, apply after total, refund more than paid.23 - **Step skipping / state**: jump to the confirmation/paid step, replay a step, reorder.24 - **Quota/limit bypass**: race the check (→ `web-race-conditions`), reset counters, parallel requests.25 - **Boundary crossing**: act on another tenant's resource (→ `web-idor`), escalate role via workflow.263. **Quantify impact** in business terms (free goods, money, privilege) for the report.2728## Gotchas29- These are context-specific — read the app like a user trying to cheat, not a scanner.30- Prove real impact (an order placed for $0, a limit bypassed), not just an odd response.31- Often chains with IDOR/race/mass-assignment — combine primitives.3233## Verify success34A completed abuse of the workflow with concrete gain (paid less/nothing, exceeded a limit,35accessed disallowed state) reproduced step-by-step.3637## References38PortSwigger business-logic labs; OWASP WSTG business-logic testing.
NoorQureshi