BSCPServer-side
Business logic flaws
Outline only. Logic flaws are rules the application forgets to enforce, not a parser bug.
8 min read · Academy topic: Business logic vulnerabilities · Outline, not a finished note
Outline. This module is on the map so you can track it. The page below is a writing checklist, not finished study material.
Objectives
- Define a logic flaw as a missing business rule
- List the flows worth mapping before this note is written up
TODO
Replace this checklist with a finished note. Do not add exploit steps.
Checklist
- A logic flaw is a workflow that allows a valid-looking action the business rule forbids: negative quantities, skipped payment, reused one-time codes, or a coupon applied twice.
- The map is the multi-step flow in order. The evidence is a final state the application should have rejected.
- In Burp, Repeater is for replaying one step out of order or twice. Compare the resulting state with a baseline purchase or transfer the lab considers honest.
- Defenders enforce the rule on the server at the moment of the state change, not in the browser, and they make the transaction idempotent where a double submit would matter.
- Cross-link the finished note to access control. A logic flaw can exist even when every object belongs to the caller.