pentest-business-logic-abuse

Business Logic Abuse

Activation Triggers (Positive)

• business logic
• workflow bypass
• race condition
• state transition
• replay
• quota abuse
• confused deputy
• delegated execution

Exclusion Triggers (Negative)

• payload fuzzing only
• endpoint recon only
• report polishing only

Output Schema

• Workflow model: step, required controls, bypass hypothesis
• Abuse sequence: ordered requests/events with timing notes
• Impact proof: unauthorized state change and resulting capability

Instructions

1. Model intended state transitions before adversarial testing.
2. Identify assumptions in sequencing, concurrency, and cross-system coordination.
3. Execute minimal abuse sequences that challenge those assumptions.
4. Confirm impact through observable unauthorized state or action outcomes.
5. Validate whether fixes require control relocation, not only input filtering.
6. Hand off only confirmed primitives for exploit execution.

Should Do

• Treat logic abuse as system-behavior testing, not payload-only testing.
• Use time-aware evidence for race and replay cases.
• Include reversible test design for stateful systems.

Should Not Do

• Do not report logic flaws without demonstrated unauthorized effect.
• Do not overuse concurrency that risks stability.
• Do not substitute theoretical abuse paths for confirmed execution evidence.