business-logic-vulnerabilities
Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.
By yaklang · 3,231 installs
npx skills add yaklang/hack-skills --skill business-logic-vulnerabilities
Source repository · Upstream listing
SKILL: Business Logic Vulnerabilities — Expert Attack Playbook
AI LOAD INSTRUCTION : Business logic flaws are scanner invisible and high reward on bug bounty. This skill covers race conditions, price manipulation, workflow bypass, coupon/referral abuse, negative values, and state machine attacks. These require human reasoning, not automation. For specific exploitation techniques (payment precision/overflow, captcha bypass, password reset flaws, user enumeration), load the companion [SCENARIOS.md](./SCENARIOS.md). For the workflow approach itself (modeling → state machine → attack surface matrix → human judgement) load [METHODOLOGY.md](./METHODOLOGY.md). For the per module check items load [CHECKLIST.md](./CHECKLIST.md).
Companion files
File When to load
[METHODOLOGY.md](./METHODOLOGY.md) Need the 5 phase workflow, attack surface 5×N matrix, human judgement decision tree
[CHECKLIST.md](./CHECKLIST.md) Going through a target module by module (login / register / payment / IDOR / privacy) and want every line item with why+verify
[SCENARIOS.md](./SCENARIOS.md) Drilling deeper into payment precision/overflow, captcha bypass, password reset, enumeration, frontend bypass
Extended Scenarios
Also load [SCENARIOS.md](./SCENARIOS.md) when you need:
Payment precision & integer overflow attacks — 32 bit overflow to negative, decimal rounding exploitation, negative shipping fees
Payment parameter tampering checklist — price, discount, currency, gateway, return url fields
Condition race practical patterns — parallel coupon application, gift card double spend with Burp group send
Captcha bypass techniques — drop verification request, remove parameter, clear cookies to reset counter, OCR with tesseract
Arbitrary password reset — predictable tokens ( md5(username) ), session replacement attack, registration overwrite
User information enumeration — login error message difference, masked data reconstruction across endpoints, base64 uid cookie manipulation
Frontend restriction bypass — array parameters for multiple coupons ( couponid[0] / couponid[1] ), remove disabled / readonly attributes
Application layer DoS patterns — regex backtracking, WebSocket abuse
1. PRICE AND VALUE MANIPULATION
Negative Quantity / Price
Many applications validate "amount 0" but not for currency:
Impact : Receive credit to account, items for free, bank transfers in reverse.
Decimal Quantity — "0元购" Case
Real instructor led case: an e commerce app accepted fractional quantity because backend trusted client float values:
Why it works: server multiplies unit price quantity without enforcing quantity ∈ Z+ , so a 2% sliver order pays 2% price but ships the full item. Reproduce by intercepting the cart submit → setting skuQty / FoodNum to 0.02 → finishing checkout.
Drop a Required Field — Free Tier Coercion
Sport activity registration: when paid prizes are involved server returns "payType": "paid" ; if the client request is edited to omit prizeIdList entirely , the server falls back to "payType": "free" and creates a successful registration that should have cost money.
This is a parameter existence trust bug — backend treats "field absent" as "no paid item to enforce", so fix is to require the field and validate its content server side.
Integer Overflow
Real case: setting amount=999999999 triggered an overflow path where the system stored 0 as final payable. Always coordinate before triggering overflow tests — they sometimes crash payment services.
Rounding Manipulation
Real "half price recharge" bug: input ¥0.019 to top up. The pay gateway charges only ¥0.01 (rounded down to the cent), but the wallet credits ¥0.02 (rounded up). Net gain per cycle is ¥0.01 , repeat for free balance growth.
Currency Exchange Rate Lag
Free Upgrade via Promo Stacking
Test combining discount codes, referral credits, welcome bonuses:
2. RACE CONDITIONS
Concept : Two operations run simultaneously before the first completes its check update cycle.
Double Spend / Double Redeem
Race Condition Test with Burp Suite
Turbo Intruder — Bypassing Per Number SMS Rate Limit
Real case: when a normal request returns "该号码短时间内申请发送短信次数过多，拒绝发送" , sending the same payload with high concurrency through Turbo Intruder defeats the simple counter:
Result: the per phone limiter races and many requests slip through, generating multiple distinct verification codes (a real SMS bombing case). Root cause: counter increment is non atomic vs. the read.
Multi Device Concurrent VIP Subscription
Real case: a service offers first month only discount . Open the pay sheet on multiple devices (A, B, C) before any payment finishes, then complete each in sequence. Server only checks "is new user?" at the first request, so all subsequent requests inherit the discount AND the VIP duration stacks.
Same trick works on "补差价升级会员" — concurrent top ups duplicate the duration credit.
Account Registration Race
Limit Bypass via Race
3. WORKFLOW / STEP SKIP BYPASS
Payment Flow Bypass
Multi Step Verification Skip
2FA Bypass
Filter Path Truncation Bypass — ..// and ;
Real case from a Java Web class audit: a manually implemented Servlet Filter checks login by inspecting the URI string. Two reliable bypasses:
Fix : never use request.getRequestURI() for security checks; use request.getServletPath() which is the normalized servlet mapped path:
When auditing Java code, grep for request.getRequestURI() paired with Filter / startsWith / indexOf("/admin") patterns — those are immediate red flags.
Real Name Verification Replay To Reset
Fraudulent path that deliberately fails real name authentication to reopen the editing flow:
Defense: rejected real name submissions must lock the account / require human review, not loop back to the editor.
Shipping Without Payment
4. COUPON AND REFERRAL ABUSE
Coupon Stacking
Referral Loop
Coupon = Fixed Dollar Amount on Variable Price Item
5. ACCOUNT / PRIVILEGE LOGIC FLAWS
Email Verification Bypass
Password Reset Token Binding
OAuth Account Linking Abuse
Cookie Replacement — Horizontal/Vertical Privilege Escalation
The textbook IDOR demo from the audit videos:
A common companion bug: /oa/emp/list returns HTTP 302 to /login when no cookie , but 200 with full data when any plain user cookie is sent — meaning the only check is "logged in?", not "authorized for this endpoint".
Permission Residue from Database Inconsistency
A subtle case from the second audit class: the admin UI shows that role X has had permission user:list revoked, but querying the SQL data:
The UI's "remove permission" only deleted ONE row; the duplicate row keeps the API accessible. Verify by:
Lesson: when a UI says permission revoked but API still works → check the underlying RBAC table for duplicates / orphaned grants.
Weak Random Password Reset Token
PHP / legacy stack on Windows uses rand() whose RAND MAX = 32768 . If a reset link uses
/resetpassword.php?id=md5(rand()) , the entire keyspace is precomputable:
Iterate the resulting dictionary against /resetpassword.php?id=<hash — when one returns a valid reset page you can change the victim's password. Audit any token generation that ultimately calls rand() , mt rand() (without seeding), Random() (default seed in C ), etc.
6. API BUSINESS LOGIC FLAWS
Object State Manipulation
Transaction Reuse
Limit Count Manipulation
Java Web "No Filter, No Spring Security" Anti Pattern
Audit friendly tell: a Spring Boot project that does NOT include spring boot starter security and has zero Filter classes. This means every controller is wide open for guest unless the developer manually checked the session in each method. Reproduce:
If both are empty, expect almost every API to be unauthorized. From the audit demo:
No check that userId matches the session's logged in user → horizontal IDOR. Worse: the same endpoint works without any Cookie , since nothing forces authentication globally.
Spring Security antMatchers Coverage Gap
The audit videos also showed a partially secured Spring Security config like:
A common error is an over narrow rule — e.g. /system/user/info is protected but /system/user/list is not, or /system/menu/ is admin only but /system/dept/treeData is open. Cross check the controller annotations ( @PreAuthorize("@ss.hasPermi('system:user:list')") ) against the SecurityConfig — every annotated endpoint must also map to a SecurityConfig rule. Mismatches are common after refactors.
7. SUBSCRIPTION / TIER CONFUSION
Direct Media URL Leak — VIP Resource Bypass
Real cases from a fitness/learning app: when the client requests course detail, the JSON response embeds the raw media URL:
Search all detail / preview / playback responses for keywords:
For each hit, replay the URL anonymously (curl, VLC, flv.js demo at https://bilibili.github.io/flv.js/demo/ ). If the URL plays without a session, you've broken VIP gating. Defense: use signed, short TTL URLs bound to user/IP/Referer, not raw resource paths.
Resource ID Replacement — Free → Paid Course
Companion bug: free course detail returns {"id": "60caa21e853f5c1651b27c1b", ...} . Replace the ID in the URL with a known paid course ID. If the response structure remains the same and includes the playable URL → IDOR on premium content. Defense: verify the owner relation on each detail call, not just "is logged in".
8. FILE UPLOAD BUSINESS LOGIC
For the full upload attack workflow beyond pure logic flaws, also load:
[upload insecure files](../upload insecure files/SKILL.md)
9. TESTING APPROACH
For the formal 5 phase workflow — Business Modeling → State Machine → Attack Surface Matrix → Checklist Driven Testing → Human Judgement — load [METHODOLOGY.md](./METHODOLOGY.md) . It includes a single page decision tree ( Q1 ~ Q7 ) for "I'm staring at a request and don't know what to try first".
10. HIGH IMPACT CHECKLISTS
For the full per module list (login / register / password recovery / payment / coupon / order / IDOR / privacy / VIP / URL redirect / cookie & token / race / comments) with why and verify columns — load [CHECKLIST.md](./CHECKLIST.md) .
The condensed top impact items below are the "if you have only 30 minutes, hit these first" set:
E commerce / Payment
Authentication / Account
Subscriptions / Limits / Resources
11. CONSOLIDATED CHECKLIST (2 Hour Full Sweep)
The Section 10 list is the "30 minute money grab". This list is the next layer:
when you have a couple of hours and want a defensive grade sweep across all
nine business surfaces. It's organized by surface, then by attack mechanism
inside the surface, so you can read a column down for "what classes of bug
might exist on this endpoint" and a row across for "where else does this
attack apply".
For full item / why / verify triplets including reproduction steps and
tooling per item, load [CHECKLIST.md](./CHECKLIST.md) . This section
keeps only the item line for fast scanning.
11.1 Login / Authentication
11.2 Registration
11.3 Password Recovery / Reset
11.4 Session / Token
11.5 Payment / Order
11.6 IDOR / Authorization
11.7 CAPTCHA / Verification Code
11.8 File Upload
11.9 CSRF / SSRF / XXE
How to Use This Section
1. Print or screenshot the relevant 1 2 sub sections for the target's surface.
2. For each □ mark: NOT APPLICABLE / NOT VULN / VULN / NEEDS RECHECK.
3. Mark the EXACT endpoint + parameter + payload that proved the bug
(or proved it absent), so the report is reproducible.
4. Cross reference with METHODOLOGY.md Q1~Q7 decision tree when an item
triggers something unexpected — the tree tells you which neighboring
items are likely also vul