Business Logic Vulnerabilities

Cross-platform resources for Business Logic Vulnerabilities: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Business Logic Vulnerabilities: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 12 challenges across 1 platform — 12 PortSwigger. 0 with a Spanish writeup, 0 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Bypassing access controls using email address parsing discrepancies (Apprentice) · 🇬🇧
2. PortSwigger — Excessive trust in client-side controls (Apprentice) · 🇬🇧
3. PortSwigger — Flawed enforcement of business rules (Apprentice) · 🇬🇧
4. PortSwigger — High-level logic vulnerability (Apprentice) · 🇬🇧
5. PortSwigger — Inconsistent security controls (Apprentice) · 🇬🇧
6. PortSwigger — Authentication bypass via encryption oracle (Practitioner) · 🇬🇧

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/logic-flaws

PortSwigger labs practicing Business Logic Vulnerabilities (12)

Lab	Difficulty	Topic	Official
Bypassing access controls using email address parsing discrepancies	APPRENTICE	Business Logic Vulnerabilities	Open
Excessive trust in client-side controls	APPRENTICE	Business Logic Vulnerabilities	Open
Flawed enforcement of business rules	APPRENTICE	Business Logic Vulnerabilities	Open
High-level logic vulnerability	APPRENTICE	Business Logic Vulnerabilities	Open
Inconsistent security controls	APPRENTICE	Business Logic Vulnerabilities	Open
Authentication bypass via encryption oracle	PRACTITIONER	Business Logic Vulnerabilities	Open
Authentication bypass via flawed state machine	PRACTITIONER	Business Logic Vulnerabilities	Open
Inconsistent handling of exceptional input	PRACTITIONER	Business Logic Vulnerabilities	Open
Infinite money logic flaw	PRACTITIONER	Business Logic Vulnerabilities	Open
Insufficient workflow validation	PRACTITIONER	Business Logic Vulnerabilities	Open
Low-level logic flaw	PRACTITIONER	Business Logic Vulnerabilities	Open
Weak isolation on dual-use endpoint	PRACTITIONER	Business Logic Vulnerabilities	Open

---

← Back to the full glossary

Last updated: 2026-08-17