InInfoSec Write-upsbyShah kaif·2d agoBreaking Business Logic: 7 Attack Scenarios in E-Commerce, Payments and Application WorkflowsBy @SKaif009 | “The request was valid. The business logic wasn’t. 💀” | Linkedin
samuel·Oct 27Business Logic Flaw: Free Checkout via Coupon StackingIntigriti October Challenge (1026) — Web Application Write-up
Yousef·Oct 22Security Write-Up: Authentication Bypass via Response Manipulation on Email Change Feature“وَمَا تَوْفِيقِي إِلَّا بِاللَّهِ ۚ عَلَيْهِ تَوَكَّلْتُ وَإِلَيْهِ أُنِيبُ”A response icon1A response icon1
Mohamed Abdelmoatie (3at3ot)·Oct 12I Asked How Guests Get Their Identity — and Found a Meeting Logic Flaw1. The Initial Clue: Understanding How Guests Are IdentifiedA response icon3A response icon3
Rohmad Hidayah·Sep 25Pages can join private Facebook groups via invitationA Page can join a private Facebook group via an invitation, even if the “Who can join the group” setting is configured to “Only profiles”.
Cybernerddd·Sep 13Logic Over Linting: How a Negative Service Charge Broke a Live Ticket CheckoutAs security researchers, we often spend our days hunting for the flashy bugs. We look for complex Cross-Site Scripting (XSS) payloads, hunt…
Rohmad Hidayah·Sep 9Logic flaw allows bypass of admin/moderator approval when editing posts in Facebook groupsGroup members can edit text posts with a colored background to another color directly without needing approval from the Facebook group Admin
Rohmad Hidayah·Sep 6A logic flaw allows a Page to join a private Facebook group via a previously approved groupPages can join private Facebook groups even if the “Who can join the group” feature is set to “Only profiles” through pre-approved groups.
redhunter01·Sep 5The $1 Full Video: How RedHunter Found and Self-Validated a Price-Integrity BypassAn anonymized case study in autonomous business-logic hunting. Target details are redacted — the value here is the mindset, not the domain.
Rohmad Hidayah·Aug 27A logic flaw allows co-hosts to enable/disable the “Guests can invite friends” feature in private…Co-hosts can enable or disable the “Guests can invite friends” feature for private Facebook events.
