> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/websec/business-logic.md).

# Business Logic

## Explanation

This entire topic is all about exploiting logic flaws within a website's code due to **flawed assumptions** about the user.

This vulnerability allows attackers to manipulate an application to elicit unintended behaviour, and they are typically caused from failure to anticipate unusual application states. I feel that these kinda of vulnerabilities are a result of developers not knowing that an attacker can even manipulate their application in that way.

One example of a logic flaw would be setting money to a negative number, thereby 'adding' money.

In general, just mess around with an application, change numbers to strings, positive integers to negative ones, and see what happens!