web-vuln-business-logic

Business logic vulnerability testing detects fraud by mapping application workflows and state transitions to find skip, replay, or manipulation attacks. It targets checkout flows, coupons, and discount engines where backend rules depend on multi-step workflows or stateful inputs.

Detect bypasses in discount engines and balance credits by mapping state transitions and sending crafted requests to observe server responses. This identifies manipulation attacks where inputs influence outcomes in stateful logic features.

To reproduce manipulation attacks on stateful logic, you need a valid test account and a proxy tool to intercept requests. Careful mapping of endpoints, tokens, and parameters is required to reproduce violations and support remediation.

Provide a reproducible sequence of curl or Burp steps to demonstrate business logic violations for remediation. This shows exactly how crafted requests manipulate stateful inputs to compromise outcomes, supporting the remediation process.

Test for replay attacks in feature-gating scenarios whenever backend rules depend on multi-step workflows or stateful inputs. This is necessary when inputs can influence outcomes in features like checkout, refunds, or any logic gated by application state.