testing-for-business-logic-vulnerabilities

Map the application's critical workflows and constraints, then tamper with price and quantity values, skip required steps, replay one-time actions, and fire parallel requests for race conditions. Confirm each finding by re-fetching the resulting state, such as order total or balance, rather than trusting an HTTP 200.

Send the request to Burp Turbo Intruder and use a single-packet race template to fire many parallel requests simultaneously. Then verify the limit-once action, such as a coupon application or fund transfer, actually occurred more than once in the account state.

Burp Suite Professional handles request interception and multi-step flow modification, Turbo Intruder covers race conditions, and Sequencer analyzes token randomness. OWASP ZAP and Postman work as alternatives, supplemented by custom bash or Python scripts.

A 200 response only means the server accepted the request; it may have recomputed or ignored the tampered value. You must re-fetch the order, cart, balance, or reward and verify the manipulated value actually persisted before reporting a hit.

Run it when automated scanners find few technical vulnerabilities, especially on e-commerce checkout flows, financial transactions, voting systems, and rate-limited features like coupons or referrals. It requires written authorization and multiple test accounts at different privilege levels.