Business logic vulnerabilities are among the most challenging to find and the most impactful when exploited. Unlike injection or configuration flaws that follow known patterns, business logic bugs are unique to each application because they exploit the specific rules and workflows the application implements. This category tests whether business processes can be bypassed, manipulated, or abused, covering everything from data validation and request forgery to file upload restrictions and rate limits. Automated security scanners cannot detect these vulnerabilities because they require understanding the application's intended behavior and testing what happens when that behavior is subverted. For penetration testers and bug bounty hunters, business logic testing is where deep application knowledge pays off with high-severity findings that others miss.
OWASP Top 10 Mapping
This testing category relates to the following OWASP Top 10 2021 categories:
Quick Reference
| Test ID | Name | CWEs | Difficulty |
|---|---|---|---|
| WSTG-BUSL-01 | Business Logic Validation | CWE-840 | Advanced |
| WSTG-BUSL-02 | Request Forgery Testing | CWE-472 | Advanced |
| WSTG-BUSL-03 | Integrity Check Testing | CWE-354 | Advanced |
| WSTG-BUSL-04 | Process Timing Testing | CWE-362, CWE-367 | Advanced |
| WSTG-BUSL-05 | Function Limit Testing | CWE-770, CWE-799 | Advanced |
| WSTG-BUSL-06 | Workflow Circumvention | CWE-841 | Advanced |
| WSTG-BUSL-07 | Application Misuse Testing | CWE-799, CWE-837 | Advanced |
| WSTG-BUSL-08 | Unexpected File Type Upload | CWE-434 | Advanced |
| WSTG-BUSL-09 | Malicious File Upload | CWE-434, CWE-509 | Advanced |
Detailed Test Cases
WSTG-BUSL-01: Business Logic Validation
AdvancedThis test checks whether the application properly validates data at the business logic level, beyond basic input validation. It examines whether business rules about data ranges, relationships between fields, and context-specific constraints are properly enforced.
What to Check
- Test boundary values for business-specific fields (quantities, amounts, dates)
- Submit negative values where only positive values should be accepted
- Test relationships between dependent fields (start date after end date, amounts exceeding limits)
- Verify that server-side business rules match client-side validation
- Check if business constraints are enforced consistently across all entry points
WSTG-BUSL-02: Request Forgery Testing
AdvancedThis test checks whether the application relies on client-side data or hidden form fields for business logic decisions that should be enforced server-side. Attackers who can forge or modify requests can manipulate prices, skip validation steps, or change transaction parameters.
What to Check
- Modify hidden form fields that control pricing or business logic
- Change product IDs or SKUs in purchase requests to get different items at wrong prices
- Manipulate request parameters that control workflow steps or approval states
- Test if removing or modifying referrer checks allows skipping validation steps
- Verify that all business-critical values are validated server-side, not just client-side
WSTG-BUSL-03: Integrity Check Testing
AdvancedThis test verifies whether the application implements integrity checks to detect unauthorized modification of data in transit or at rest. It checks for mechanisms like checksums, digital signatures, and tamper-evident logging that protect against data manipulation.
What to Check
- Check if the application uses checksums or HMACs to verify data integrity
- Test whether modifying data in transit (cookies, hidden fields, API payloads) is detected
- Verify that audit logs are tamper-evident and modifications are detectable
- Test if transaction integrity is maintained across multi-step processes
- Check whether data integrity verification covers all critical data paths
WSTG-BUSL-04: Process Timing Testing
AdvancedThis test checks whether the application is vulnerable to timing-based attacks on business processes. This includes race conditions where concurrent requests can bypass limits, time-of-check-to-time-of-use (TOCTOU) bugs, and timing-based information leakage.
What to Check
- Test for race conditions by sending concurrent requests for the same operation
- Check if time-sensitive operations (OTP validation, coupon redemption) are vulnerable to replay
- Test for TOCTOU vulnerabilities in multi-step business processes
- Measure response time differences that might leak information about internal state
- Verify that rate-limiting and balance checks are atomic operations
WSTG-BUSL-05: Function Limit Testing
AdvancedThis test checks whether the application enforces limits on how many times specific functions can be used. This includes rate limiting, usage quotas, one-time-use features (coupons, vouchers, trials), and maximum attempt limits.
What to Check
- Test if single-use features (coupons, voucher codes, trial activations) can be reused
- Check if rate limiting exists on sensitive operations (login attempts, API calls, downloads)
- Verify that rate limits are enforced server-side and cannot be bypassed
- Test if changing session identifiers, IP addresses, or accounts bypasses usage limits
- Check if free trial limits can be circumvented through account creation
WSTG-BUSL-06: Workflow Circumvention
AdvancedThis test checks whether the application enforces the intended sequence of steps in multi-step processes. Attackers may attempt to skip, reorder, or repeat steps in workflows like registration, checkout, or approval processes to achieve unintended outcomes.
What to Check
- Test if steps in multi-step processes can be skipped by directly requesting later steps
- Check if workflow steps can be completed out of order
- Verify that completing a workflow step requires all previous steps to be genuinely completed
- Test if repeating earlier steps after completing later steps causes inconsistencies
- Check whether canceling and restarting workflows preserves or resets state correctly
WSTG-BUSL-07: Application Misuse Testing
AdvancedThis test evaluates whether the application has defenses against abuse of legitimate functionality. This includes detecting and blocking automated bot activity, identifying suspicious usage patterns, and implementing safeguards against feature abuse at scale.
What to Check
- Test if automated interactions are detected and blocked (CAPTCHAs, bot detection)
- Check if suspicious usage patterns trigger alerts or account restrictions
- Verify that abuse-prevention measures cannot be easily bypassed
- Test if the application logs and monitors for abnormal usage patterns
- Check if there are mechanisms to recover from detected abuse scenarios
WSTG-BUSL-08: Unexpected File Type Upload
AdvancedThis test checks whether the application properly restricts file upload functionality to only accept intended file types. Accepting unexpected file types can lead to web shell uploads, stored XSS through HTML/SVG files, or server-side processing vulnerabilities through malicious documents.
What to Check
- Test if the application validates file types by extension, MIME type, and file content (magic bytes)
- Try uploading executable files with changed extensions (.php.jpg, .asp;.jpg)
- Test if MIME type validation can be bypassed by modifying Content-Type headers
- Upload HTML and SVG files that contain JavaScript to test for stored XSS
- Check if uploaded files are served from a separate domain to prevent same-origin attacks
WSTG-BUSL-09: Malicious File Upload
AdvancedThis test goes beyond file type restrictions to check whether the application is vulnerable to malicious content within uploaded files. This includes web shells, documents with embedded macros, polyglot files, and specially crafted files that exploit processing vulnerabilities.
What to Check
- Upload web shells disguised as allowed file types (PHP in JPEG, JSP in PDF)
- Test for ZIP bomb or decompression bomb handling
- Upload files with embedded macros or active content
- Test for file processing vulnerabilities (ImageTragick, LibreOffice CVEs)
- Check if antivirus scanning is performed on uploaded files before they are accessible
Relevant Certifications
The following certifications cover business logic testing concepts:
Frequently Asked Questions
What are business logic vulnerabilities and why are they hard to find?
Business logic vulnerabilities are flaws in the application's intended workflow that allow users to achieve outcomes the developers did not anticipate. They are hard to find because they require understanding the application's business rules and testing edge cases that automated scanners cannot identify. Examples include skipping required steps in a checkout process, manipulating quantities to get negative prices, or reusing single-use coupon codes.
Can automated scanners detect business logic flaws?
No, automated scanners generally cannot detect business logic flaws because these vulnerabilities require understanding the intended behavior of the application. A scanner cannot know that skipping step 3 of a 5-step process should not be allowed, or that a coupon should only work once. Manual testing by someone who understands the application's business rules is essential for finding these issues.
What is the relationship between business logic testing and threat modeling?
Threat modeling identifies potential business logic abuse scenarios before testing begins by analyzing how the application's features and workflows could be manipulated. It asks questions like 'What if a user submits step 4 before step 2?' or 'What if the quantity is negative?' This systematic approach ensures business logic testing is comprehensive rather than relying on ad-hoc exploration.
CyberFolio
Mastering web security testing? Showcase your skills.
Build a free, shareable cybersecurity portfolio that highlights your certifications, projects, and skills.
Build Your Portfolio →