vulns.cofield index
Enter
Contribute
Testing playbook · intermediate

Business Logic Flaws

Break the intended rules of a workflow - the bugs scanners never find.

logicworkflowabuse-case
Stable IDplaybook:business-logicLast updatedLast verifiedLegacy review pendingProvenanceCurated workflow
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

01

Model the intended flow

Diagram every step, precondition, and trust assumption (price, quantity, role, state transitions).

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
02

Break assumptions

Negative/huge quantities, skipping steps, replaying completed steps, tampering client-set prices/discounts, and manipulating currency/rounding.

Burp Suite
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
03

Abuse trust between components

Confuse the app about who did what: parameter pollution, second-order inputs, and reusing tokens across contexts.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes

Common guidance

  • Always ask 'what is this feature trying to prevent?' then do exactly that.
  • Discount/refund/points systems are perennial goldmines.
Related tools

Mapped workflow tools

ToolBurp Suite
Sources

References

Version history: normalized permanent page created 2026-08-20.