Advanced Web, API & Modern Stack
Business Logic Vulnerabilities — Concept + Live Lab
Bugs scanners can't find: price tampering, coupon abuse, OTP & workflow flaws.
Open the interactive lesson & lab →
Business logic flaws are bugs in how an application's rules work — not a technical injection. The code runs exactly as written, but the logic allows abuse. Automated scanners miss these entirely, so they're pure human skill (and often high bounty).
Common logic abuses
- Price / quantity tampering — client-controlled price, or negative quantities that flip the total.
- Coupon abuse — stacking or reusing single-use discount codes.
- OTP / rate-limit bypass — no lockout, so a 4-6 digit code is brute-forceable.
- Workflow bypass — skipping a payment or verification step by going straight to a later endpoint.
- Wallet / refund abuse — race or logic that lets you withdraw or refund more than allowed.