Flow integrity asks whether the story of a workflow is coherent before you analyze races or numeric tampering. The planner splits it into sequencing (order, approvals, reversals) and state alignment (what the UI, database row, and session each believe).
Child topics#
- Sequencing: Step skip, out-of-order access, approval bypass, parameter omission, entitlement renewal, reversal workflows.
- State alignment: UI vs record vs session checkpoints.
- Parallel effects: Races, double spend, callback replay (sibling under workflow).
Trust boundaries for numeric and business parameters: Trust boundaries.
Tools#
- Burp Suite (Repeater): replay and reorder captured workflow steps to probe sequencing and state alignment.
- Manual testing with Burp Repeater and crafted payloads.
References#
- PortSwigger Web Security Academy: Business logic vulnerabilities
- OWASP WSTG: Testing for Business Logic