Business Logic Flaws: Breaking the Rules the App Never Wrote Down

What it is#

These bugs have no scanner signature and no single payload, because they're not a broken filter or an unescaped string. They're a step in the app's own workflow that can be skipped, repeated, or reordered in a way its design never accounted for. Understanding the feature matters more than any tool here.

The labs here#

• CoworkNow hidden-price tampering: the price for a booking is sent from the client as a hidden form field, and the server trusts it instead of looking the real price up itself.
• FreshBox referral credit loop: the "one credit per distinct new person" rule is enforced with an exact string comparison on email addresses. Throwaway address variations (plus-aliases, or a handful of free mailboxes) all count as distinct as far as that check is concerned, so the "one per person" rule doesn't actually hold.
• SummitPass upgrade wizard step-skip: a four-step wizard (choose tier, review, pay, confirm) is enforced only by which page the UI shows you next. The confirm endpoint itself never checks that a payment actually happened first, so calling it directly skips straight to the reward.