Identifying Key Application Workflows

Hello! Welcome back to your web application analysis training.

In our last lesson, you learned how to build a comprehensive map of an application's attack surface using Burp Suite's automated and semi-automated tools. You now know how to find both linked and unlinked content, which is a critical first step.

However, a map of endpoints is just a starting point. It tells you what exists, but not how it works or why it's there. The most impactful vulnerabilities often hide not in single, isolated endpoints, but in the interactions between them. Today, we shift our focus from automated discovery to manual, intellectual analysis. We will dive into the core logic of an application to understand its key processes.

This lesson covers how to manually browse an application to identify key user workflows and business logic. This skill is essential for finding the subtle but severe logic flaws that automated scanners will always miss and is a hallmark of an expert penetration tester and bug bounty hunter.

1. What Are Workflows and Business Logic?

Before we start browsing, let's define our terms.

• User Workflow: A sequence of steps a user takes to complete a task. Examples include the user registration process, a password reset flow, or the multi-step checkout in an e-commerce store.
• Business Logic: The set of rules that dictates how an application should behave based on its purpose. For example, business logic determines if a user is eligible for a discount, what actions an "admin" user can perform versus a "regular" user, or how inventory is managed when an item is purchased.

Finding flaws in business logic means finding cases where the application's implementation doesn't correctly enforce these rules, allowing an attacker to make the application do something it shouldn't.

This short video provides a great introduction to business logic errors and the mindset required to find them.

The key takeaway is that we need to first understand the application from a user's perspective before we can effectively attack it from a hacker's perspective.

2. A Methodology for Manual Exploration

A random, unstructured approach to browsing is inefficient. A professional uses a systematic methodology. Let's build one based on expert advice.

Step 1: Discover and Understand the Application's Purpose

Your first goal is to use the application as intended. Create accounts, explore every feature, and try to understand the "meaning behind the functions."

As you do this, you're not just clicking. You're building a mental model of the application. Given your computer science background, you can think of this as reverse-engineering the application's state machine or high-level algorithm.

Step 2: Map Key Multi-Step Workflows

While exploring, pay special attention to critical, multi-step workflows. These are often where complex logic resides and where developers' assumptions can be violated. Document the steps for processes like:

• User registration and authentication
• Password reset and recovery
• Profile management (updating email, password, etc.)
• Shopping cart and checkout processes
• Administrative functions (if you have access)
• Any core feature specific to the application (e.g., posting a message, uploading a file, booking a reservation).

For each workflow, note the sequence of HTTP requests in Burp Suite. You're trying to understand the chain of events that leads to a specific outcome.

Step 3: Formulate Hypotheses and Test Assumptions

Once you understand how a workflow is supposed to function, you can start thinking about how to break it. This involves challenging the assumptions the developers likely made.

The PortSwigger Web Security Academy provides an excellent breakdown of these flawed assumptions.

This leads to a powerful, hypothesis-driven testing approach. For any given workflow, you can formulate specific questions (hypotheses) and use your tools to test them.

A helpful framework for this is outlined in the article "Advanced Web App Security Testing." The author suggests a focused session where you choose a target flow and formulate hypotheses like:

• Forced Browsing: Can I directly access a restricted page (e.g., /admin/dashboard) without logging in?
• Sequence Break: In a checkout process (/cart, /payment, /confirm), can I jump from /cart directly to /confirm?
• Parameter Tampering: In a request to update my profile (POST /api/user/update), can I add an isAdmin=true parameter?
• Unconventional Input: What happens if I try to purchase a negative quantity of an item?

This practical demonstration shows exactly how to use Burp Repeater to "fiddle with parameters" and test these kinds of hypotheses.

3. Case Studies: Logic Flaws in the Wild

Understanding the theory and methodology is one thing; seeing the impact is another. The following case studies demonstrate the powerful results of applying this manual, logic-focused approach.

Conclusion

You've now moved beyond simple enumeration and into the thought process of a security tester. While automated tools can find the "low-hanging fruit," the ability to understand and deconstruct an application's business logic is what separates beginners from experts. It's a skill that requires curiosity, creativity, and a systematic approach.

Key Takeaways:

• Manual browsing is a goal-oriented process to understand an application's purpose, workflows, and business rules.
• User workflows are the intended sequences of user actions, while business logic is the set of rules the application enforces.
• Logic flaws often arise from flawed developer assumptions about user behavior—that users will always follow the intended path and provide expected input.
• A systematic testing approach involves:
  1. Understanding the application as a normal user.
  2. Mapping critical multi-step workflows.
  3. Formulating hypotheses to challenge assumptions (e.g., breaking sequences, tampering with parameters).
  4. Testing these hypotheses with tools like Burp Repeater.

Next Lesson Preview:
So far, we have focused on the application's structure and its high-level, server-side logic. But modern web applications execute a significant amount of code directly in your browser. In the next lesson, we will learn how to use browser developer tools to inspect and analyze client-side code (HTML, CSS, and JavaScript). This will open up a new class of vulnerabilities and help you understand how the front-end and back-end work together.