What Are We Missing in Web Application?

The talk argues that modern frameworks and scanners already handle common injection and XSS issues, but they miss business logic flaws, where an application lets users skip or reorder steps in an intended workflow. These flaws often pay the highest bounties, and the presenter treats them as a design problem as well as a coding one.

The main case study is a 2019 CVE in Oracle Financial Services fraud management software used by banks. A low-privilege reporting user could capture requests made by an admin, change identifiers and then see admin logs and alerts, because the server returned data without checking the user's rights. Other examples covered OTP flows in banking applications: one app accepted a wrong code and still let the login proceed on retry, and another accepted a previously saved valid server response in place of a fresh check.

The practical advice is to test with several user roles and compare access across them, model each workflow to find where checks are missing, and validate input on the server rather than relying on client-side controls. Teams should also ask business and application owners detailed questions about data flow before launch. Manual testing with an intercepting proxy, supported by role-swapping plugins, is presented as the way to find these flaws.