Business Logic labs
Business Logic Vulnerabilities
What is Business Logic?
Business Logic vulnerabilities are flaws in the application's design that let attackers manipulate legitimate business processes. They don't break the technology, but the business rules: order of operations, client-only validation, free-trial abuse.
Why practice Business Logic?
Scanners don't detect these bugs — only experienced, creative hunters find them. That's why bounties are high and competition is low. Every case is unique, and practicing with real reports is the only way to develop the eye and the mental pattern.
What will you learn with the Business Logic labs?
You'll learn to read business flows like code (registration, checkout, refund, password change), spot client-only validations the backend trusts, chain steps out of order (skipping payment), and report with a narrative PoC the triager can reproduce in 30s.
Types of Business Logic we cover
- Payment bypass
Change the price in the POST body, complete an order without paying, race condition on stock.
- Coupon abuse
Apply the same coupon N times via race, combine supposedly exclusive coupons, tamper the discount field.
- Workflow skipping
Skip steps of a multi-step process (skip email verification, skip phone verification, skip onboarding).
- Free trial farming
Multiple free trials with one email + aliases or (.) variants the dedup doesn't normalize.
How do you find and exploit Business Logic?
A practical playbook — from recon to proof of concept.
- 1
Understand the flow as a business
Walk the full process (checkout, refund, transfer) noting each step, what the client validates and what the server does, and what would happen if you break the order.
cart → address → payment → confirmation (what does each hop validate?) - 2
Tamper values that should be fixed
Change price, quantity, currency, discount or state in the body. If the backend trusts the client data, you make money or skip controls.
POST /checkout {"item":"x","price":0.01,"qty":-5} - 3
Skip workflow steps
Call the final step directly, omitting intermediate verifications (email, phone, payment). Many apps don't check that the previous ones were completed.
POST /order/confirm (without going through /order/pay) - 4
Abuse limits and promotions
Reapply single-use coupons (often via race), combine mutually-exclusive offers or reset free trials by normalizing the email.
victim+1@x.com / vic.tim@x.com (same inbox, naive dedup) - 5
Document the economic impact
Narrate the abuse step by step and quantify the loss to the business: that's the argument that raises severity.
Bought the Pro plan for €0.01 instead of €99, reproducible
Learn the theory
Academy: Payments & Stripe Security
Loading labs...
View in full catalog →Frequently asked questions
What is a Business Logic vulnerability?
It's a flaw in the design of the business process, not the technology: the attacker uses legitimate functions in an unintended order or with unintended values (change the price, skip payment, reuse coupons) to gain an improper benefit.
How is a business logic flaw exploited?
You manipulate data that should be fixed (price, quantity, state), skip steps of a multi-stage flow, or abuse limits (coupons, trials) by exploiting the fact that the backend trusts client validations or doesn't verify the order of operations.
How do you find Business Logic in bug bounty?
Scanners don't catch these: you have to understand the business. Walk checkout, refunds, transfers and registration thinking 'what happens if I put a negative number, skip this step or repeat this action'. That's why they pay well and have little competition.
How do you prevent Business Logic flaws?
Validate every rule on the server (never trust the client), verify the state and order of each flow step, recompute prices and discounts in the backend, and implement idempotency and server-side limits on promotions and trials.
Difference between Business Logic and a technical flaw like XSS or SQLi?
XSS or SQLi exploit a technical defect (unsanitized input). Business Logic doesn't break the technology: it uses the functions as they exist but in a way the business didn't intend. That's why they require human creativity and don't show up in automated scanners.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Business Logic in real labs
Every Business Logic lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime