Business logic
A logic bug is a workflow that accepts a state the product tried to forbid: a skipped step, a replayed step, or a price the client chose. Scanners do not model that rule. You do, from the flow in front of you.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
None linked for this class yet.
Disclosures
- A negative quantity changed the amount charged - Business logic errors
Playbooks
- Business Logic Flaws - Break the intended rules of a workflow - the bugs scanners never find.
Questions
Is a negative quantity a finding?
Only when the server stores it and the ledger or the next step treats it as valid. A field that rejects the value is the control. Record both.
How is this different from access control?
Access control asks whether account A can touch account B's object. Logic asks whether an account you own can finish a flow the product does not allow. Report the rule you actually broke.
This page is the linked pack hunt_brief("logic") returns on the MCP connector. Authorized testing only.