Web Application Logic Mapper

Purpose

Map application workflows, state machines, and hidden surfaces so downstream validation starts from concrete routes, actions, and trust boundaries.

Use When

• The owner phase is spidering, crawling, hidden route discovery, state-machine mapping, workflow modeling, or route-to-action relationship mapping.
• Recon has found a live application surface but not enough workflow context for focused validation.

Scope

• Complex multi-step workflows (checkout, registration, approval processes).
• State-dependent actions (e.g., "Draft" -> "Pending" -> "Published").
• Hidden or undocumented API endpoints and parameters.

Inputs

• Spider/Crawl Data: List of discovered URLs and forms.
• API Documentation: Swagger/OpenAPI specs, WSDLs (if available).
• User Manuals/Help Docs: Descriptions of intended workflows.