Business Logic — HackXpert Labs

🧩 Business Logic

Every request is valid. The order, the timing or the arithmetic is what breaks. No scanner finds these, which is exactly why they pay.

7 labs and targetsfree, no accountlesson included

How business logic & timing actually works — taught by The XSS Rat

What it is

This is the class scanners cannot touch, because nothing is malformed. You are not breaking the code, you are breaking the assumptions behind it: that a discount is applied once, that a coupon is single use, that two requests never arrive at the same moment.

How I attack it

Understand what the feature is worth in money or access before you poke it. That is what tells you where to push.
Do things out of order, twice, or halfway. Go back a step after confirming. Replay an old step with new values.
Watch rounding, currency, quantity and negative numbers wherever value is calculated.
For race conditions, send the same request in parallel rather than quickly in sequence - the window is usually milliseconds wide.