Business Logic Error Methodology (easy way) + PoC-s

, or hacking the website’s functionality by editing HTML code on the fly

I have found this type of bug once 3 years ago, and I was amazed by its existence. And then I found it again a few days ago. Amazing. But, in order to know what to look for first, it’s all about mapping the web application.

What to map — the easy approach:

Figuring out the logic behind how anything works can get complicated. But, sometimes there are breadcrumbs that one can easily follow, at least for the quick and easy test.

When I hear business logic the first thing that comes to mind is — business of some kind. Now, what every business has to have is a way to make money. Thus, the easy websites to look at are those that offer free and paid plans. With more paid plans there is more to test, and the pricier that the affected plan is the greater severity of the bug.

You can’t click the disabled button, or can you?

Some websites limit the paid features by hiding them, others by showing them, but with links/buttons to reach those features disabled. End of the road? Not necessarily. Now, the long way around to get to those features is to figure out with which requests they are associated with. Which can be a…