Business Logic Flaws

Tags: logic, workflow, abuse-case

Level: intermediate

Method

1. Model the intended flow

   Diagram every step, precondition, and trust assumption (price, quantity, role, state transitions).

2. Break assumptions

   Negative/huge quantities, skipping steps, replaying completed steps, tampering client-set prices/discounts, and manipulating currency/rounding.

   Tools: Burp Suite

3. Abuse trust between components

   Confuse the app about who did what: parameter pollution, second-order inputs, and reusing tokens across contexts.

Field notes

• Always ask 'what is this feature trying to prevent?' then do exactly that.
• Discount/refund/points systems are perennial goldmines.

References

• https://owasp.org/Top10/A04_2021-Insecure_Design/