mitm-find-bizlogic

查找业务逻辑漏洞

分析 mitmproxy 转储文件（log.txt），查找以下业务逻辑缺陷：$ARGUMENTS

要求：当前目录中必须有 log.txt。如果文件不存在，请先捕获流量：

mitmdump --set flow_detail=3 2>&1 | tee log.txt

高价值业务逻辑模式（来自 376 份真实 HackerOne 漏洞赏金报告）

1. 支付／定价操纵

漏洞赏金中的真实案例：

• Uber：绕过 paymentProfileUUID，实现免费乘车
• 使用负数数量滥用退款
• 操纵购物车价格
• 叠加使用优惠券／促销代码
• 滥用货币兑换

搜索模式：

grep -iE '(price|amount|total|cost|fee|discount|coupon|promo|payment)' log.txt
grep -iE '(quantity|qty|count|num)[=:]["'\'']?-?[0-9]+' log.txt

2. 绕过账户／电子邮件验证

真实案例：

• Acronis：通过更改未经验证的电子邮件地址接管账户
• 未经验证即可更改电子邮件地址
• 绕过电话验证
• 账户删除不彻底

搜索模式：

grep -iE '(verify|confirm|validate|activate|email|phone)' log.txt
grep -iE '(change|update).*(email|phone|password)' log.txt

3. 绕过速率限制／暴力破解

真实案例：

• OTP 验证没有速率限制
• 绕过登录尝试次数限制
• 利用并行请求
• 通过 API 绕过 CAPTCHA

搜索模式：

grep -iE '(otp|code|pin|token|verify)' log.txt
grep -iE '(limit|rate|attempts|retry|captcha)' log.txt

4. 竞争条件

真实案例：

• 钱包中的双重消费
• 并发兑换优惠券
• 并行提交转账请求
• 通过竞争操作操纵投票

查找：

- Financial transactions (transfer, payment, redeem)
- Limited resource operations (claim, reserve, book)
- State-changing operations (status update, approve)

5. 绕过工作流／状态

真实案例：

• 跳过多步骤流程中的步骤
• 无订阅即可使用功能
• 绕过审批工作流
• 操纵考试／测验结果

搜索模式：

grep -iE '(step|stage|phase|status|state|workflow|approve)' log.txt
grep -iE '(submit|complete|finish|process)' log.txt

漏洞类别与严重性

类型	严重性	影响
绕过／操纵支付	CRITICAL	财务损失
通过逻辑缺陷接管账户	CRITICAL	账户完全失陷
通过工作流提升权限	HIGH	未经授权的访问
免费使用高级功能	HIGH	收入损失
数据操纵	MEDIUM	数据完整性问题
绕过速率限制	MEDIUM	潜在滥用
通过逻辑缺陷泄露信息	LOW	隐私泄露

测试方法

步骤 1：梳理业务流程

# Find transaction-related endpoints
grep -iE 'POST.*(order|payment|checkout|cart|purchase|subscribe|redeem)' log.txt

# Find state-changing endpoints
grep -iE 'POST.*(update|change|modify|set|create|delete)' log.txt

# Find verification flows
grep -iE '(verify|confirm|validate|check|otp|code)' log.txt

步骤 2：测试参数操纵

# Price manipulation
# Original: {"price": 100, "quantity": 1}
# Test: {"price": 1, "quantity": 1}
# Test: {"price": 100, "quantity": -1}

# Status manipulation
# Original: {"status": "pending"}
# Test: {"status": "approved"}

# Role manipulation
# Original: {"plan": "free"}
# Test: {"plan": "premium"}

步骤 3：测试竞争条件

# Send concurrent requests
for i in {1..10}; do
  curl -X POST 'https://target.com/api/redeem' -d '{"code":"PROMO123"}' &
done
wait

# Check if code was redeemed multiple times

步骤 4：测试工作流绕过

# Skip step 2, go directly to step 3
curl 'https://target.com/api/checkout/step3' -d '{"order_id":"123"}'

# Access premium without subscription
curl 'https://target.com/api/premium/feature' -H 'Cookie: free_user_session'

真实攻击场景

场景 1：通过绕过支付档案免费乘车

1. Capture ride request with paymentProfileUUID
2. Remove or modify paymentProfileUUID field
3. Server doesn't validate, processes ride without payment
4. Unlimited free rides

场景 2：通过更改电子邮件地址接管账户

1. Victim signs up with email but doesn't verify
2. Attacker changes email via API (no verification required)
3. Attacker now controls account with their email
4. Reset password → full takeover

场景 3：优惠券竞争条件

1. Find single-use coupon worth $100
2. Send 10 concurrent redeem requests
3. Race condition allows multiple redemptions
4. Get $1000 discount instead of $100

场景 4：操纵考试分数

1. Take online exam, submit answers
2. Intercept response with score
3. Find score calculation endpoint
4. Replay with modified answers or directly set score

可操纵的参数

财务参数

price, amount, total, subtotal, tax
discount, discount_percent, coupon_value
quantity, qty, count, num
currency, currency_code
payment_method, payment_id
tip, fee, shipping_cost

状态参数

status, state, phase, step
is_verified, is_active, is_premium
approved, confirmed, completed
role, plan, tier, subscription

身份参数

user_id, account_id, profile_id
email, phone, username
referral_code, invite_code

输出格式

## Business Logic Finding: [Brief Description]

**Endpoint**: `METHOD https://target.com/path`
**Flow**: [Payment|Registration|Verification|Workflow]
**Severity**: [CRITICAL|HIGH|MEDIUM|LOW]

**Normal Flow**:
1. User does X
2. Server validates Y
3. Action Z occurs

**Exploit Flow**:
1. User does X
2. User manipulates [parameter]
3. Server fails to validate
4. Unauthorized action occurs

**Evidence**:
[Request/response showing manipulation]

**Impact**:
- Financial loss of $X per abuse
- Account compromise
- Unauthorized access to premium features

**Test Command**:
curl -X POST 'https://target.com/...' -d '{"manipulated":"value"}'

**Remediation**:
- Server-side validation of all parameters
- Signed/encrypted values for sensitive data
- Idempotency keys for financial operations
- Rate limiting on sensitive endpoints

可忽略的误报

• 仅在客户端执行计算（由服务器端验证）
• 操纵后会返回错误的参数
• 非生产环境中的调试／测试端点
• 有意设置为宽松的速率限制
• 有意免费／开放使用的功能