2.3 - Logic Flaws Identification

Goal

The aim here is to scrutinize the application’s business logic and identify potential flaws that could be exploited by attackers. This involves thinking critically about how the application is supposed to function and identifying scenarios where its logic could be subverted.

How to Execute

1. Understand the Application’s Business Logic
   • Description: Gain a thorough understanding of the application’s intended functionality and the logic behind its operations. This understanding is crucial for identifying deviations and weaknesses that could be exploited.
   • Tools/Techniques:
     • Review application documentation, use cases, and user stories to understand the intended behavior.
     • Review the application’s GitHub issues to identify logic flaws that could lead to security issues, or examine issues already marked for security consideration so we can create a proof of concept to demonstrate their impact.
     • Conduct interviews with developers, business analysts, and product owners to gain insights into the application’s design and operational logic.
   • Output: A detailed understanding of the application’s business processes and logic pathways.

1. Conduct Brainstorming Sessions
   • Description: Organize brainstorming sessions with a diverse group including security professionals, developers, and potentially users, to think through potential misuse cases.
   • Tools/Techniques:
     • Employ structured brainstorming techniques like STRIDE or attack trees to guide the discussion.
     • Use whiteboarding sessions to visually map out potential attack vectors based on the business logic.
   • Output: A collection of potential logic flaws and the corresponding attack vectors that could exploit these flaws.

1. Prototype and Test Attack Scenarios
   • Description: Prototype potential attack scenarios based on the identified logic flaws. This step involves creating conditions under which the business logic can be tested to see if the flaws can be exploited.
   • Tools/Techniques:
     • Develop test cases that simulate the attack scenarios identified during the brainstorming sessions. (we can put these up in our RTM)
     • Use automated testing tools to execute these scenarios and observe the outcomes.
   • Output: Documented results from testing which confirm whether the identified logic flaws can be exploited and the severity of their potential impact.