Business logic
A logic bug is a workflow that accepts a state the product tried to forbid: a skipped step, a replayed step, or a price the client chose. Scanners do not model that rule. You do, from the flow in front of you.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
None linked for this class yet.
Disclosures
No public card yet.
Playbooks
- Business Logic Flaws - Break the intended rules of a workflow - the bugs scanners never find.
Questions
Is a negative quantity a finding?
Only when the server stores it and the ledger or the next step treats it as valid. A field that rejects the value is the control. Record both.
How is this different from access control?
Access control asks whether account A can touch account B's object. Logic asks whether an account you own can finish a flow the product does not allow. Report the rule you actually broke.
This page is the linked pack hunt_brief("logic") returns on the MCP connector. Authorized testing only.