Sequencing is the timeline axis of flow integrity: what must happen before what, which human or system approvals gate transitions, and how renewal or reversal paths interact with capture and settlement.
Pages#
| Page | Focus |
|---|---|
| Step skip | Forced browsing to later steps |
| Out-of-order step access | Revisit intermediate steps |
| Parameter omission abuse | Optional fields that gate logic |
| Approval bypass | Maker-checker and approvals |
| Entitlement renewal bypass | Trials, renewals, re-verification gaps |
| Reversal and refund abuse | Refunds, chargebacks, settlement races |
Tools#
- Burp Suite (Repeater): replay and reorder captured steps to force sequencing bugs.
- Manual testing with Burp Repeater and crafted payloads.
References#
- PortSwigger Web Security Academy: Business logic vulnerabilities
- OWASP WSTG: Testing for Business Logic