Trust boundaries are the edges where data leaves one enforcement context and enters another: from browser to API, from microservice A to B, or from synchronous form to async job. The library focuses on numeric and business parameters that are easy to tamper when hidden fields or JWT claims are trusted blindly.
Pages#
| Page | Focus |
|---|---|
| Numeric integrity | Prices, fees, tax lines, quantities |
| Business parameters | Product SKU, shipping tier, entitlement tier |
Tools#
- Burp Suite (Repeater): tamper numeric and business parameters as they cross steps, then replay to commit.
- Manual testing with Burp Repeater and crafted payloads.
References#
- PortSwigger Web Security Academy: Business logic vulnerabilities
- OWASP WSTG: Testing for Business Logic