Exploiting Business Logic Vulnerabilities

Hello! Welcome to your next lesson in the Authorization Bypass & Logic Flaws module.

In our previous lesson, we focused on finding what isn't meant to be seen, using forced browsing to uncover hidden endpoints, admin panels, and forgotten APIs. That was about attacking the parts of an application that are intentionally obscured.

Today, we shift our perspective entirely. We will focus on attacking the application's intended functionality. Instead of looking for hidden doors, we're going to walk through the front door but behave in ways the developers never anticipated. This lesson addresses the learning outcome: Identify and exploit business logic flaws, such as price manipulation in e-commerce applications.

These vulnerabilities are often missed by automated scanners and require a creative, human-centric approach, making them a favorite among bug bounty hunters. Your background in computer science will be an asset here, as we'll explore how flawed assumptions in application logic can lead to critical security risks.

1. What Are Business Logic Flaws?

Unlike technical vulnerabilities like SQL Injection or XSS, which exploit weaknesses in code implementation, business logic flaws exploit weaknesses in the application's design and assumptions about user behavior. The application might be technically secure, but its workflow can be manipulated to produce an unintended, insecure outcome.

To get a foundational understanding, let's start with a video that explains what these errors are and why they are a great target for bug hunters.

Finding Your First Bug: Business Logic Errors

The video "Finding Your First Bug: Business Logic Errors" from InsiderPhD provides an excellent introduction to this class of vulnerabilities. It explains the core concept and why they are less about technical knowledge and more about understanding the application's flow.

Please watch from 01:05 to 03:43. Focus on how business logic errors are defined as attacking the logical flow of an application rather than its technical implementation.

The key takeaway is that you are not trying to break the code; you are trying to abuse the rules of the business process itself.

2. The Mindset: How to Think About Logic Flaws

Finding business logic flaws requires a specific methodology. You must first understand the application's intended workflow and then systematically probe for flawed assumptions.

Business Logic Vulnerabilities | Complete Guide

This video, "Business Logic Vulnerabilities | Complete Guide" by Rana Khalil, outlines a more formal methodology and provides several excellent examples that illustrate how developers' assumptions can be turned into vulnerabilities.

Watch the section "How to find business logic vulnerabilities" from 12:34 to 16:23. Pay close attention to the proposed methodology: Map the entire application and its components. Determine the potential business flow and developer assumptions. Test use cases outside of the intended business flow (e.g., performing steps out of order).

This systematic approach is crucial. Automated scanners fail here because they don't understand the context or the purpose of the application. That's your job as the tester.

3. A Prime Example: Price Manipulation in E-commerce

The most classic and high-impact business logic flaw is price manipulation. The goal is simple: make the application charge you less than it should. This is almost always caused by the server trusting data sent from the client (your browser).

Price Manipulation in E-Commerce Websites — This diagram illustrates a common price manipulation attack. An attacker uses a proxy like Burp Suite to intercept an order request and change the price from 10,000 to 1 before it reaches the server. The vulnerability exists because the server fails to validate the price on the backend.

There are several ways to achieve this. Let's look at the most common techniques.

Hunting the 6 most common price manipulation ...

The article "Hunting the 6 most common price manipulation..." from Intigriti provides a superb catalog of these attack vectors. It's a great checklist to have in mind when testing any e-commerce site.

Read the section "Exploiting price manipulation vulnerabilities". You don't need to read the intro again. Focus on understanding these six techniques: Formula injection via price tampering: Directly changing the price parameter in a request. Formula injection via quantity tampering: Using negative or decimal quantities to reduce the total price. Integer overflow: Providing a very large quantity that the backend might misinterpret as 0 or a negative number. Coupons: Abusing coupon logic (e.g., multiple redemptions, using expired codes). Currency confusion: Changing the currency (e.g., from USD to INR) while keeping the amount the same. Accepted test cards: Finding if the production environment still accepts developer test credit card numbers.

These techniques all stem from one root cause: the server trusts the client. As a developer, you know that all client-side input must be validated. As a penetration tester, your job is to find where that validation is missing.

4. Case Study: A $2,000 Price Manipulation Bug

Now let's see how these concepts translate into a real-world bug bounty. The following article details how a researcher earned a $2,000 bounty by finding a simple logic flaw that allowed them to purchase expensive products for free.

$2000 Logic Flaw: Free Products via URL Tampering

This blog post, "$2000 Logic Flaw: Free Products via URL Tampering," is a perfect walkthrough of discovering and exploiting a business logic flaw. It shows the researcher's thought process from start to finish.

Please read the article, focusing on these parts: Introduction and Setting the Scene: Understand the target and the context. Step 1 - Reconnaissance & Observation: Note how the researcher used Burp Suite to identify a suspicious parameter: id_product_feature_set. Step 2 & 3 - The Hypothesis & The Experiment: This is the core of the attack. See how they formed a hypothesis about the parameter's function and used Burp Repeater to test it with invalid values (-1, null). Step 4 - The Backend Logic Breakdown: With your CS background, you'll find this section particularly interesting. It speculates on the code-level mistakes (query failure, array out-of-range) that could have led to the bug. Step 11 - Lessons for Bug Hunters: Pay close attention to the key takeaways for your own work.

This case study beautifully illustrates the process: observe normal traffic, identify a parameter that controls business logic, form a hypothesis, and test that hypothesis by tampering with the parameter's value.

Test your understanding!

You are testing an e-commerce website. You add a laptop worth $1500 to your cart. The site offers a "loyalty" discount: if you add a $50 branded mouse pad to the cart, you get a 10% discount on the entire order.

You intercept the "Add to Cart" request for the mouse pad in Burp Suite. It looks like this:
POST /api/cart/add HTTP/1.1
...

{"product_id": "MP-01", "quantity": 1, "price": 50.00}

Describe three different business logic tests you would perform, explaining what you would change and what you hope to achieve.

Show answer

Here are three distinct business logic tests based on the concepts we've learned:

Discount Retention Abuse:
- Action: First, add both the laptop and the mouse pad to the cart to get the 10% discount. Then, send a request to remove the mouse pad from the cart.
- Goal: To see if the 10% discount remains applied to the laptop even after the qualifying item (the mouse pad) has been removed. This tests if the application fails to re-validate the discount conditions.
Quantity Tampering / Formula Injection:
- Action: Add the $1500 laptop to the cart. Then, intercept the request to add the mouse pad and change its quantity from 1 to -1. Forward the manipulated request.
- Goal: To see if the backend logic subtracts the mouse pad's price from the total. If the total is calculated as (Laptop Price * 1) + (Mouse Pad Price * -1), you might be able to buy the laptop for $1450 instead of $1500.
Price Tampering:
- Action: Intercept the request to add the $1500 laptop to the cart and change the price in the JSON body from 1500.00 to 1.00.
- Goal: This is the most direct test. You want to see if the server blindly trusts the price sent from the client. If it does, the laptop would be added to your cart for only $1.00.

Conclusion

Today you've learned about a class of vulnerabilities that requires more than just technical skill—it requires curiosity, creativity, and a deep understanding of the application's business purpose.

Key Takeaways:

Business logic flaws exploit the intended workflow of an application by making it perform actions in an unforeseen and insecure order.
These flaws are highly contextual and almost impossible for automated scanners to find, making them a valuable target for manual testing.
Price manipulation in e-commerce is a critical and common example, often caused by the server implicitly trusting client-side data like price, quantity, or currency.
The core methodology is to understand the rules, then creatively break them using tools like Burp Suite to tamper with requests.

Next Lesson Preview:
In this lesson, we manipulated values within a business process. In the next lesson, we will explore a related concept: testing application workflows for bypass vulnerabilities that allow skipping critical steps entirely. Imagine a multi-step checkout process where you can jump directly from the "shopping cart" page to the "order confirmed" page, bypassing the payment step altogether. This is another powerful type of logic flaw that we will learn to identify and exploit.