Business Logic and Authorization Bypass
Break the rules, not the parser
Logic flaws need no malformed input; they need a sequence of legitimate requests in an illegitimate order. Start by writing the intended workflow as state steps, then look for steps that can be skipped, repeated, or reordered. Typical cases: checkout that trusts a client-supplied price or discount, negative quantities that credit an account, coupon codes applied twice, password reset that validates the token before the identity, and confirmation pages reachable without the preceding step.
Race conditions belong here. When a check and a use are separated (balance check then debit, coupon validation then redemption, invite acceptance then role grant), send parallel requests so both pass the check before either commits. Synchronize with a last-byte or single-packet technique where latency matters.
Mass assignment and hidden fields: any object bound from request parameters may accept fields the UI never shows - isAdmin, price, owner_id, verified. Also test HTTP method tampering (PUT or PATCH on endpoints that only check GET and POST), parameter pollution (id=1&id=2), and content-type switching, which can bypass body validation entirely.
Authorization bypass overlaps: forced browsing to admin routes, changing a numeric id, and calling internal APIs that assume the gateway already checked permissions.
Traps: assuming the UI enforces anything; testing only sequential requests; assuming a decimal quantity is validated as positive; and missing that idempotency keys or nonces can be reused.
Rule of thumb: for every multi-step flow, ask what the server knows at each step without the previous one, then replay the final request cold with a fresh session.