Lion Cipher Lab
Find and fix business-logic flaws in a checkout (the bugs no scanner flags)
- AppSec / DevSecOps
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Most of the security tools you will meet look for broken input: a quote that breaks a SQL query, a script tag, a string where a number should be. Business-logic flaws have no broken input. A quantity of -400 is a valid number. A price of 1.00 is a valid price. Confirming an order is a valid request. The bug is that the application lets these well-formed requests do something the business never meant to allow, like selling a laptop for a dollar or shipping goods nobody paid for. Scanners and schema validators cannot find this, because they do not know what your shop is for. Only a person who…
What you'll learn
- explaining what a business-logic flaw is: a request that is perfectly well-formed but makes the application do something its owner never intended
- building a small checkout service and abusing it seven ways: a client-chosen price, a negative quantity, a fractional quantity, a stacked coupon, a reused coupon, a total below zero and an order that ships unpaid
- measuring why type and schema validation cannot see these bugs (0 of 39 abusive requests flagged in this lab)
- fixing them with server-side rules: prices from a catalog, whole-number quantities within a limit, one coupon per order and per account, a minimum spend, and a state machine for the order status
- writing an abuse-case test suite that checks both sides: every abuse is blocked AND every honest order is still charged the right amount
- knowing the limit of that suite: it only catches the abuses someone thought of, shown by a split-line rounding trick that passes every rule
Steps in this lab
- What a business-logic flaw is, and why a scanner walks past it
- Build the vulnerable checkout (shop_vuln.py)
- Write the validator a generic tool would give you (schema_check.py)
- Write the abuse-case suite (abuse_suite.py)
- Measure BEFORE: 7 of 7 abuses work and the validator flags 0 of 39
- Fix it by putting the rules on the server (shop_fixed.py)
- Measure AFTER: 0 of 7 abuses work and 3 of 3 honest orders still pass
- The honest negative: an abuse nobody encoded still gets through
- When to reach for this, and how a pro does it better