Business-logic abuse
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
see attacks that use the API exactly as designed.
Planned topics
- Credential stuffing: stolen passwords tried at scale. Defend with rate limits, MFA, breached-password checks.
- Scraping and bots: price scraping, inventory hoarding. Defend with rate limits, behavior signals, challenges.
- Promo and refund abuse: reusing codes, many accounts, race conditions on "one per customer".
- Controls: server-side limits per account/device/IP, atomic checks (unique constraint), monitoring of unusual patterns.
- No scanner finds these; only people who know the business do.
Draft outline details
Demonstration
abuse-case table for checkout: coupon reuse, cart hoarding, refund abuse, with a control for each.
Check your understanding
Why can scanners not find promo abuse?
Show answer
Each request is valid; the abuse lies in the business rules.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.