vapt-logic

Business Logic Testing

When Invoked

The user runs /vapt logic <url> or this skill is triggered as part of Wave 3 during /vapt audit.

Important Note

Business logic testing is inherently application-specific and mostly manual. This skill provides a structured methodology and specific test scenarios rather than automated scans. The tester must understand the application's business domain to execute these tests effectively.

Prerequisites

Check for existing context:

• If VAPT-WAVE2-CONTEXT.md exists -> use discovered functionality
• If other VAPT output files exist -> use to understand the application's features
• If no context -> crawl the application to identify key workflows

Phase 1: Application Profiling

1.1 Identify Business Functions

Crawl and analyze the application to identify:

• User registration / onboarding flow
• Authentication flows (login, password reset, MFA)
• E-commerce functions (cart, checkout, payment)
• Content management (create, edit, delete)
• Communication features (messaging, comments, sharing)
• Administrative functions
• Export / import features
• Search functionality
• File upload / download
• Subscription / billing

1.2 Map Multi-Step Workflows

For each workflow, document:

1. The expected sequence of steps
2. Required inputs at each step
3. Validation rules between steps
4. Expected outcomes

Phase 2: Workflow Bypass Testing

2.1 Step Skipping

For multi-step processes (checkout, registration, wizards):

# Instead of: Step 1 -> Step 2 -> Step 3 -> Complete
# Try: Step 1 -> Step 3 -> Complete (skip Step 2)
# Try: Directly access Complete step
curl -s -X POST <url>/api/checkout/complete -H "Authorization: Bearer <token>" \
    -d '{"order_id":"123"}'

2.2 Step Reordering

Can steps be performed out of order? Does the server validate state?

2.3 Scoring

Finding	Severity	CVSS
Payment bypass via step skipping	Critical	9.8
Verification bypass (email, phone)	High	7.5
Non-critical step skippable	Low	3.5