Breaking The Giants With Logic

The talk frames business logic vulnerabilities as flaws that do not trigger errors or crashes, but instead let people use a feature in ways its designers never intended. The speaker argues that common automated tooling produces duplicate findings in bug bounty programs, so researchers benefit from reasoning about what a feature is supposed to do. A simple example is an e-commerce checkout where a client-supplied price parameter is changed before the order is submitted.

The middle of the talk walks through several cases. A password reset link carrying a sequential user ID let an attacker reset another account's password despite a strong token. Invitation links were next: altering group or sender identifiers, member type values, or reusing an invite could allow joining restricted groups, impersonating an inviter, or escalating privileges. Two case studies followed. In Facebook groups, a preview state kept a user hidden from admins while retaining rejoin access, and a removed feature's backend still accepted requests. On Instagram, a blocked account could still be followed, letting the user watch content unseen.

The closing advice is to use an application as a regular user before automating, learn which features and controls are weak, and read disclosed reports. Patterns found on one platform often recur on others, which motivates the speaker's plan to build a tool for hunting invitation-style flaws. The Q&A touched on whether stored invitations could enable denial of service, judged an unlikely edge case, and on how often backend remnants of removed features remain reachable.