This lesson covers a class of vulnerability that does not look like a vulnerability in source code. The request body is well formed. The field names are correct. The values are syntactically valid. The database accepts the write. Nothing looks wrong.
Scope reminder: perform workflow tampering only against systems you own or are explicitly authorized to test. The bundled NovaCart application instance is the authorized lab target for this lesson.
What is wrong is the semantics: the application allows a transaction that the business never intended to permit, because the rule that would have rejected the transaction was enforced in the wrong layer.
The typical wrong layers are:
- The HTML input element — the form field you type into on a webpage. Developers can add attributes like
min="1"ormax="99"that tell the browser to refuse out-of-range values, but the server receives the raw network request and does not automatically re-apply those same limits. - The JavaScript validator — a script that runs inside the browser and checks the entered value before the form is submitted. Because the attacker controls their own browser, they can disable or bypass this script entirely and send whatever value they like.
- The "happy path" through the user interface — the normal, intended sequence of clicks and form submissions. An attacker skips the interface and sends the underlying HTTP request directly, bypassing every check the interface performs.
- The dropdown of available options — a menu that hides an expired coupon from the picker. Hiding an option on screen does not prevent a caller from submitting the expired code directly to the server endpoint.
In this lesson you will:
- Inspect NovaCart's basket quantity control and reason about where the "positive integer" rule is enforced.
- Construct an HTTP request body that places an order with a negative quantity, mapping to NovaCart's Payback Time challenge.
- Submit the request through the application and observe whether the server accepts what the user interface refused.
- Discuss coupon expiry, single-use rewards, and the durable fix that applies to all of these patterns.
Estimated time: twenty to twenty-five minutes.
Prerequisites: browser-recon for the Network tab, http-fundamentals for request bodies and methods, and broken-access-control for the authorization boundary that overlaps with object-level business rules. The hands-on step can be completed entirely through the browser developer tools — no intercepting proxy is required for the core exercise. intercepting-proxies is useful background for the optional proxy-based and curl replay methods, but is not a hard prerequisite for this lesson.
When you are ready, send the Continue signal.