Business logic flaws
You find the flaws scanners miss, born from the developer’s assumptions, by mapping the workflow, then close and monitor them with a server-side state machine, abuse-case tests and business metrics.
Level 301 · 15 lessons · 13 practice labs
Lessons
What a logic flaw is
- Flaws scanners cannot find: broken assumptions
- Mapping the workflow: steps, states and rules
- Listing the developer’s assumptions
- Short task: draw the state machine of a checkout flow
Typical patterns
- Price and quantity tampering: negative numbers and rounding
- Skipping steps: reaching the confirmation page without paying
- Abusing coupons, points and gift cards
- Exceeding limits: quotas, attempts and free trials
- Trusting decisions made on the client
- Short task: evidence three logic flaws in the lab shop
Fixing and monitoring
- A server-side state machine and invariants
- Turning abuse cases into tests
- Anomaly detection with business metrics: refunds, coupons and orders
- Working with the fraud team: security and the business side
- Capstone: find and close the logic flaws in an e-commerce flow and write monitoring rules
Practice labs
- The state machine of a checkout flow: Draw the lab shop's steps from basket to confirmation as a state machine and mark the transitions that must not be allowed.
- List the developer's assumptions: Study the refund feature's code and UI to find five assumptions the server never checks and turn them into test cases.
- A discount decision that comes from the client: Prove the discount rate is sent by the client and move the calculation to the server.
- Abuse cases from the flow map: Derive ten abuse cases from the map of the gift card flow, confirm three in the lab and fix them.
- A basket total lowered by a negative quantity: Prove that adding a negative quantity lowers the basket total and validate the quantity on the server.
- Jumping to the confirmation page without paying: Prove order confirmation is reachable by skipping the payment step and bind confirmation to payment status.
- Applying the same coupon again and again: Show a single-use coupon can be applied again through different spellings and normalise and limit it per order.
- Profit from a rounding difference: Show in the lab that rounding in currency conversion produces gains on small amounts and fix it with a decimal type.
- Renewing a free trial: Prove the same user gets the trial again with small changes and bind the entitlement to a verified identity.
- A refund larger than the order: Show partial refunds can add up to more than the order total and add the invariant on the server.
- Turn an abuse case into a test: Write automated tests that check the business rule for three logic flaws you closed and show they catch a deliberate regression.
- Anomalies in coupon and refund metrics: Write a query that finds accounts with unusual coupon and refund rates in order data and set an alert threshold.
- A logic review of an e-commerce flow: Find and close the logic flaws in the basket, coupon and refund flow of the fictional Miraluna Flowers shop and write a monitoring rule.
About this course
You find the flaws scanners miss, born from the developer’s assumptions, by mapping the workflow, then close and monitor them with a server-side state machine, abuse-case tests and business metrics.
What you will learn
- What a logic flaw is
- Typical patterns
- Fixing and monitoring
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.