Business Logic Flaws Pentesting
Your Code Works Perfectly. That's Exactly the Problem

// This code passes every security scan. Zero warnings.
// But it has a critical business logic flaw.

app.post('/api/cart/add', async (req, res) => {
  const { productId, quantity } = req.body;
  
  // Looks fine, right? Find the product, calculate total.
  const product = await Product.findById(productId);
  const lineTotal = product.price * quantity;
  
  // Add to cart and respond
  await Cart.addItem(userId, productId, quantity, lineTotal);
  res.json({ success: true, total: lineTotal });
});

// The attack: quantity = -10, product.price = $100
// lineTotal = -$1000. User now has a $1000 CREDIT.

// Your scanner sees: Valid JavaScript. No injection.
// Clean code. Ship it!

// The vulnerability: check-then-act without proper locking

async function redeemCoupon(userId, couponCode) {
  // Step 1: Check if coupon is still valid
  const coupon = await Coupon.findOne({ code: couponCode });
  if (!coupon || coupon.redeemed) {
    return { error: "Invalid or already redeemed" };
  }
  
  // Step 2: Apply the discount (takes a few ms)
  await applyDiscount(userId, coupon.value);
  
  // Step 3: Mark coupon as used
  coupon.redeemed = true;
  await coupon.save();
}

// The attack: 50 parallel requests, all hit Step 1 before
// any reach Step 3. Result? 50x the discount.

# Attack command:
for i in {1..50}; do
  curl -X POST https://app.com/api/redeem \
    -d '{"code":"SAVE100"}' &
done
wait

// Your intended flow:
// 1. POST /signup (create account)
// 2. GET /verify-email?token=xyz (click email link)
// 3. POST /add-payment (enter credit card)
// 4. GET /dashboard (access premium features)

// The attack: Go straight to step 4
const response = await fetch('/api/dashboard/data', {
  headers: { 
    'Authorization': 'Bearer ' + sessionToken 
  }
});

// If your backend trusts the frontend to enforce the flow,
// the attacker now has full dashboard access.
// No email verified. No payment added.

// Why this happens:
// - Frontend uses redirects to enforce flow
// - Backend checks "is user logged in?" 
// - Backend never asks "did they complete onboarding?"

// Money transfer endpoint
app.post('/api/transfer', async (req, res) => {
  const { amount, recipientId } = req.body;
  
  // Check if sender has enough balance
  if (sender.balance >= amount) {  // 1000 >= -500? TRUE!
    sender.balance -= amount;      // 1000 - (-500) = 1500
    recipient.balance += amount;   // Their balance decreases!
    
    await sender.save();
    await recipient.save();
    return res.json({ success: true });
  }
  
  return res.json({ error: "Insufficient funds" });
});

// Attack request: { amount: -500, recipientId: "victim" }
// Result: Attacker GAINS $500, victim LOSES $500

// One line prevents this entire attack vector:
// if (amount <= 0) return res.status(400).json({error: "Invalid amount"});