Business Logic Flaw Identification Quiz

1. True or False: A business logic flaw requires code injection or memory corruption to be exploited.

True

False

2. A business logic vulnerability that allows a user to bypass a required approval step before completing an action is best mitigated by which approach?

Enforcing sequential workflow validation on the server

Increasing password complexity

Installing a WAF

Using HTTPS only

Submit

4. A subscription service allows users to extend their trial period indefinitely by repeatedly triggering the 'extend trial' workflow. What is missing?

Logic to enforce extension limits

SSL certificate

Firewall rules

Antivirus scanning

5. An application grants 'admin' access to any user whose profile includes an 'is_admin=true' parameter. What is the root cause?

Trusting client-supplied authorization data

Missing rate limiting

Weak password hashing

Unvalidated redirects

6. True or False: Business logic flaws are always detectable through static code analysis alone.

True

False

7. A user can delete another user's account by manipulating the user ID parameter without proper authorization. What is this called?

Insecure direct object reference (IDOR)

Cross-site request forgery

Session hijacking

Privilege escalation

Submit

9. A coupon code meant for new customers can be used unlimited times by existing customers. What flaw allows this?

Insufficient state validation

Unpatched software

Weak SSL configuration

Missing input sanitization

10. An online banking system allows fund transfers without re-authenticating the user during the transaction. What is the primary risk?

Session fixation

Missing transaction verification

Weak password policy

Unencrypted communication

11. A web application allows users to modify the 'quantity' parameter in a shopping cart before checkout. What type of business logic flaw is most likely present?

Input validation bypass

Insufficient authorization checks

SQL injection vulnerability

Cross-site scripting

Submit

14. Which scenario best describes a workflow bypass vulnerability?

Skipping mandatory steps in a multi-step process

Guessing a user's password

Intercepting encrypted traffic

Accessing files outside the intended directory

15. A user can bypass age verification by submitting a birth date parameter in a GET request. What vulnerability category does this fall under?

Broken authentication

Weak business logic enforcement

Insecure direct object references

Sensitive data exposure

16. An application allows a user to request a password reset and immediately use an old password before the reset completes. What flaw is this?

Inadequate process isolation

Buffer overflow

Format string vulnerability

Hardcoded credentials

17. A payment processing workflow accepts payment before verifying the user's account status. What business logic issue is demonstrated?

Missing step validation

Insufficient cryptography

XML external entity (XXE)

Command injection

18. An e-commerce site calculates discounts server-side but allows clients to submit a modified discount code parameter. What is this flaw called?

Broken access control

Client-side validation bypass

Insecure deserialization

Path traversal

19. Which attack exploits a race condition where two simultaneous requests both pass authorization checks before one is recorded?

Time-of-check-time-of-use (TOCTOU)

Man-in-the-middle

Brute force attack

Dictionary attack

PenTest+ V2 Business Logic Flaw Identification Quiz

1. True or False: A business logic flaw requires code injection or memory corruption to be exploited.

2.

What first name or nickname would you like us to use?

2. A business logic vulnerability that allows a user to bypass a required approval step before completing an action is best mitigated by which approach?

3. The practice of verifying authorization at the correct point in an application's workflow is called____control implementation.

4. A subscription service allows users to extend their trial period indefinitely by repeatedly triggering the 'extend trial' workflow. What is missing?

5. An application grants 'admin' access to any user whose profile includes an 'is_admin=true' parameter. What is the root cause?

6. True or False: Business logic flaws are always detectable through static code analysis alone.

7. A user can delete another user's account by manipulating the user ID parameter without proper authorization. What is this called?

8. When two concurrent requests both receive approval before inventory is decremented, resulting in overselling, this is a____condition.

9. A coupon code meant for new customers can be used unlimited times by existing customers. What flaw allows this?

10. An online banking system allows fund transfers without re-authenticating the user during the transaction. What is the primary risk?

11. A web application allows users to modify the 'quantity' parameter in a shopping cart before checkout. What type of business logic flaw is most likely present?

12. An application processes refund requests without verifying if the original purchase occurred. This is an example of____validation.

13. A privilege escalation via business logic occurs when a user can____their role without proper authorization.

14. Which scenario best describes a workflow bypass vulnerability?

15. A user can bypass age verification by submitting a birth date parameter in a GET request. What vulnerability category does this fall under?

16. An application allows a user to request a password reset and immediately use an old password before the reset completes. What flaw is this?

17. A payment processing workflow accepts payment before verifying the user's account status. What business logic issue is demonstrated?

18. An e-commerce site calculates discounts server-side but allows clients to submit a modified discount code parameter. What is this flaw called?

19. Which attack exploits a race condition where two simultaneous requests both pass authorization checks before one is recorded?