Business Logic Invariant Testing
PhantomYerra uses Claude to read your application's source code, derive security rules (invariants) that must always be true, then automatically generate test cases that try to violate them. No other tool does this.
What Are Business Logic Vulnerabilities?
Business logic vulnerabilities are flaws in the design or implementation of an application's intended behaviour. Unlike technical vulnerabilities (SQL injection, XSS), these cannot be detected by signatures or pattern matching - they require understanding what the application is supposed to do and finding ways to make it behave incorrectly.
Price Manipulation
An e-commerce checkout applies discount codes after calculating tax. An attacker intercepts the request and replaces the final price with a negative value, receiving a refund on purchase.
POST /api/checkout
{"items": [...], "total": -99.99, "coupon": "SAVE10"}
Account Takeover via Workflow Bypass
A password reset flow has three steps: request → verify OTP → set password. The third step does not verify the OTP was actually validated: it only checks that the reset token exists.
POST /api/reset/set-password
{"token": "abc123", "new_password": "hacked"}
# Step 2 (OTP verify) never called
Quantity Underflow
A shopping cart allows negative quantities. Setting quantity to -1 reduces the cart total, and applying a 100% discount coupon results in the store paying the attacker.
PUT /api/cart/items/42
{"quantity": -1, "product_id": "premium-item"}
Race Condition - Double Spend
A wallet transfer deducts balance after confirming the transfer. Sending two simultaneous transfer requests for the full balance before either deduction completes allows spending the same funds twice.
# Two simultaneous requests, full balance each
curl -X POST /api/transfer -d '{"amount": 1000}' &
curl -X POST /api/transfer -d '{"amount": 1000}' &
How Invariant Discovery Works
PhantomYerra's AI reads your source code and derives security invariants - statements about what must always be true in a correctly functioning application. This is the foundation of business logic testing.
Source Code Input
Routes, controllers, models, auth middleware
AI Invariant Discovery
Claude reads code, derives rules that must always hold
Fuzzer Generation
AI writes test cases to violate each invariant
Live Testing
Tests run against target - violations become findings
Example Invariants Discovered
Using the Business Logic Tester
Open Business Logic Tester
In the Scan Wizard, select Business Logic Testing as a scan surface, or navigate to Scans → Business Logic from the sidebar.
Provide Source Code
Upload your application's source directory, paste a repository URL for PhantomYerra to clone locally, or select a previously analysed codebase from the project library. PhantomYerra accepts Node.js, Python, Ruby, Java, Go, .NET, and PHP applications.
Review Discovered Invariants
After analysis (typically 30-90 seconds), PhantomYerra displays all discovered invariants grouped by category: Authentication, Authorisation, Financial, Workflow, Data Integrity, Rate Limiting. Review and deselect any invariants that are intentionally flexible in your application.
Configure Target and Credentials
Set the base URL of the running application and provide authentication credentials for at least one standard user account. For privilege escalation testing, provide credentials for multiple roles.
Run the Tests
Click Start Business Logic Scan. PhantomYerra generates and executes test cases for each invariant. Violations that are confirmed with working exploit evidence are automatically escalated to findings.
Adding Custom Invariants
You can manually define invariants that the AI may not have discovered from source code, or that describe business rules specific to your domain.
Custom Invariant Format
{
"name": "No free upgrades via price override",
"description": "The final billing amount for a subscription upgrade must match the Stripe price ID for the selected tier. Client-side price manipulation must be rejected.",
"test_vectors": [
{"field": "price_id", "tamper": "price_free_tier", "expect_rejection": true},
{"field": "amount", "tamper": 0, "expect_rejection": true},
{"field": "amount", "tamper": -1, "expect_rejection": true}
],
"severity": "critical",
"category": "financial"
}
Where to Add Custom Invariants
In the Business Logic Tester, click Add Custom Invariant in the invariants panel. Fill in the name, description, and test vectors using the format above. Custom invariants are saved to your project and reused on subsequent scans.
Integration with the Full Scan Pipeline
Business Logic Testing integrates smoothly with PhantomYerra's full attack chain analysis. Invariant violations discovered during business logic testing are automatically correlated with findings from DAST, authentication testing, and IDOR testing to build complete multi-step attack chains.
Example Attack Chain
[RECON] Discovered checkout API endpoint via crawler
↓
[BUSINESS LOGIC] Invariant violation: negative quantity accepted
↓
[EXPLOITATION] Cart total reduced to -$500 with coupon SAVE100
↓
[IMPACT] Store issues $500 refund to attacker card
↓
[CHAIN] Combined with IDOR on /api/orders/{id} → attacker can replay other users' orders with negative totals