Most hunters lose because they look for payloads.
High-impact bugs come from logic flaws.

If recon is where to attack, logic testing is how you win.

1. Stop Thinking “Vulnerability” — Start Thinking “Assumption”

Developers build features based on assumptions:

• “The user will follow the UI”
• “This request will only come from this page”
• “This ID belongs to the logged-in user”
• “This step will always happen before the next one”

Your job is to violate assumptions.

Every serious bug bounty finding starts with:

“What if this assumption is wrong?”

2. The 5 Logic Questions You Must Ask on Every Feature

Whenever you see any feature, ask:

Can I skip a step?

Can I repeat a step?

Can I reorder steps?

Can I change someone else’s data?

Can I do this without proper authorization?

If you build this habit, you will find bugs consistently.

3. Authorization Bugs: The Silent Money-Makers

Authorization issues are everywhere and massively under-tested.

Practical checklist:

• Change user_id, account_id, order_id
• Swap numeric IDs with UUIDs and vice versa
• Test read vs write permissions separately
• Test “view” endpoints for “edit” functionality
• Check admin-only endpoints with user tokens

Common mindset mistake:

“The UI doesn’t allow it, so it must be safe”

Backends don’t trust UIs. Or at least, they shouldn’t.

4. Workflow Abuse (Where Most Critical Bugs Live)

Look at multi-step flows:

• Password reset
• Email change
• Checkout
• KYC verification
• Refunds
• Subscription upgrades
• Account deletion

Try this:

• Complete step 1
• Skip step 2
• Jump directly to step 3
• Replay old requests
• Use expired tokens

If the backend allows it → you win.

5. Race Conditions: Bugs for the Patient

Race conditions are logic bugs, not magic.

Where to look:

• Payments
• Coupons
• Wallet credits
• Resource creation
• Rate-limited actions

Simple test:

• Send the same request multiple times simultaneously
• Observe balance changes, status updates, duplicates

Most hunters ignore these because they require patience, not tools.

6. BOLA / IDOR: Still Alive, Still Paying

BOLA (Broken Object Level Authorization) is not beginner stuff — it’s backend trust failure.

Practical testing:

• Capture one legitimate request
• Change object identifiers
• Observe responses, not status codes only
• Compare behavior across roles

If the API trusts object IDs more than user identity, you’ve found gold.

7. APIs Lie. Observe Behavior, Not Words

APIs may return:

• 403 Forbidden
• 401 Unauthorized
• 200 OK

None of these mean anything alone.

What matters:

• Did the data change?
• Did the action complete?
• Did the backend accept it silently?

Always verify state change.

8. Why Most Hunters Miss Logic Bugs

Because logic bugs:

• Require understanding the product
• Cannot be automated
• Take time
• Need curiosity

Most hunters want fast results.
Great hunters want repeatable success.

🔥 Episode 3 Summary

• Logic bugs come from broken assumptions
• Always question workflows and permissions
• Skip, replay, reorder, and duplicate actions
• BOLA and authorization bugs remain top-tier
• Observe backend behavior, not responses
• Logic > payloads > tools