Business Logic Abuse

Use When

• The main question is workflow bypass, race condition, replay, quota abuse, confused deputy behavior, or unauthorized state transition.
• A mapped workflow has meaningful business impact if steps are reordered, skipped, repeated, or delegated.

Handoff Criteria

• Hand off to pentest-web-application-logic-mapper when the workflow is not mapped well enough to test.
• Hand off to pentest-input-protocol-manipulation when parser or payload behavior becomes the main blocker.
• Hand off to pentest-exploit-execution-payload-control only after a deterministic business-logic primitive exists.

Output Schema

• Workflow model: step, required controls, bypass hypothesis
• Abuse sequence: ordered requests/events with timing notes
• Impact proof: unauthorized state change and resulting capability