Most hunters lose because they look for payloads.
High-impact bugs come from logic flaws.
If recon is where to attack, logic testing is how you win.
1. Stop Thinking “Vulnerability” — Start Thinking “Assumption”
Developers build features based on assumptions:
- “The user will follow the UI”
- “This request will only come from this page”
- “This ID belongs to the logged-in user”
- “This step will always happen before the next one”
Your job is to violate assumptions.
Every serious bug bounty finding starts with:
“What if this assumption is wrong?”
2. The 5 Logic Questions You Must Ask on Every Feature
Whenever you see any feature, ask:
Can I skip a step?
Can I repeat a step?
Can I reorder steps?
Can I change someone else’s data?
Can I do this without proper authorization?
If you build this habit, you will find bugs consistently.
3. Authorization Bugs: The Silent Money-Makers
Authorization issues are everywhere and massively under-tested.
Practical checklist:
- Change user_id, account_id, order_id
- Swap numeric IDs with UUIDs and vice versa
- Test read vs write permissions separately
- Test “view” endpoints for “edit” functionality
- Check admin-only endpoints with user tokens
Common mindset mistake:
“The UI doesn’t allow it, so it must be safe”
Backends don’t trust UIs. Or at least, they shouldn’t.
4. Workflow Abuse (Where Most Critical Bugs Live)
Look at multi-step flows:
- Password reset
- Email change
- Checkout
- KYC verification
- Refunds
- Subscription upgrades
- Account deletion
Try this:
- Complete step 1
- Skip step 2
- Jump directly to step 3
- Replay old requests
- Use expired tokens
If the backend allows it → you win.
5. Race Conditions: Bugs for the Patient
Race conditions are logic bugs, not magic.
Where to look:
- Payments
- Coupons
- Wallet credits
- Resource creation
- Rate-limited actions
Simple test:
- Send the same request multiple times simultaneously
- Observe balance changes, status updates, duplicates
Most hunters ignore these because they require patience, not tools.
6. BOLA / IDOR: Still Alive, Still Paying
BOLA (Broken Object Level Authorization) is not beginner stuff — it’s backend trust failure.
Practical testing:
- Capture one legitimate request
- Change object identifiers
- Observe responses, not status codes only
- Compare behavior across roles
If the API trusts object IDs more than user identity, you’ve found gold.
7. APIs Lie. Observe Behavior, Not Words
APIs may return:
- 403 Forbidden
- 401 Unauthorized
- 200 OK
None of these mean anything alone.
What matters:
- Did the data change?
- Did the action complete?
- Did the backend accept it silently?
Always verify state change.
8. Why Most Hunters Miss Logic Bugs
Because logic bugs:
- Require understanding the product
- Cannot be automated
- Take time
- Need curiosity
Most hunters want fast results.
Great hunters want repeatable success.
🔥 Episode 3 Summary
- Logic bugs come from broken assumptions
- Always question workflows and permissions
- Skip, replay, reorder, and duplicate actions
- BOLA and authorization bugs remain top-tier
- Observe backend behavior, not responses
- Logic > payloads > tools