{"id":2716,"date":"2026-11-04T07:48:18","date_gmt":"2026-11-04T07:48:18","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2716"},"modified":"2026-11-04T07:49:59","modified_gmt":"2026-11-04T07:49:59","slug":"portswigger-business-logic-lab-5-low-level-logic-flaw","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/11\/04\/portswigger-business-logic-lab-5-low-level-logic-flaw\/","title":{"rendered":"PortSwigger Business Logic Lab 5: Low-level Logic Flaw"},"content":{"rendered":"\n

Bu labda, PortSwigger Web Security Academy\u2019nin Business Logic kategorisindeki \u201cLow-level logic flaw\u201d senaryosunu inceliyoruz. Sepete \u00fcr\u00fcn eklerken uygulanan adet s\u0131n\u0131r\u0131na ra\u011fmen ayn\u0131 iste\u011fin tekrar g\u00f6nderilebilmesi, toplam tutar\u0131n tam say\u0131 s\u0131n\u0131r\u0131n\u0131 a\u015farak negatif de\u011fere d\u00f6nmesine neden oluyor. Amac\u0131m\u0131z, bu tam say\u0131 ta\u015fmas\u0131ndan yararlan\u0131p sepet tutar\u0131n\u0131 mevcut bakiyemizle \u00f6denebilecek bir seviyeye getirerek \u201cLightweight l33t leather jacket\u201d \u00fcr\u00fcn\u00fcn\u00fc sat\u0131n almak. Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n

D\u00fcr\u00fcst olaca\u011f\u0131m, gece ge\u00e7 saatlerde lab\u0131 \u00e7\u00f6zmek i\u00e7in oturmu\u015ftum. Ancak hem uykumun bask\u0131n gelmesi hem de sudan sebeplerden laba odaklanamad\u0131m. Sabah uyand\u0131\u011f\u0131mda \u00e7\u00f6z\u00fcme bakt\u0131m. Herh\u00e2lde ke\u015ffetmem \u00e7ok uzun zaman al\u0131rd\u0131. Akl\u0131ma gelmeyecek bir yerden \u00e7\u00f6z\u00fcm\u00fc oldu lab\u0131n.<\/p>\n\n\n\n

Son derece her yer korunakl\u0131 g\u00f6z\u00fck\u00fcyor ama san\u0131rsam b\u00fcy\u00fck numaralarda arka planda Java s\u00fcre\u00e7leri do\u011fru handle edemiyor. De\u011fi\u015fkenlerin s\u0131n\u0131rlar\u0131na geldi\u011fimizde say\u0131lar negatiften geri ba\u015fl\u0131yor. Ne demek istiyorum? \u00d6n tarafta bir \u00fcr\u00fcn al\u0131rken max 99 adet tek seferde alman\u0131za izin veriyor ve bunun kontrol\u00fc backend\u2019de de var. Ancak \u00f6nemli olan iste\u011fin tekrar edilebiliyor olmas\u0131. S\u00fcrekli yeni al\u0131m yap\u0131ld\u0131\u011f\u0131nda toplam \u00f6denilmesi gereken fiyat da artacak ama bu sonsuza m\u0131 gidecek?<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

Yukar\u0131daki gibi bir yap\u0131 olu\u015fturdum kontroll\u00fc bir \u015fekilde say\u0131 negatif oldu\u011funda durdurabilmek i\u00e7in.<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

Yukar\u0131daki g\u00f6rselde g\u00f6r\u00fcld\u00fc\u011f\u00fc gibi bakiye art\u0131yordu s\u00fcrekli ancak belirli bir noktadan sonra bakiye negatife d\u00f6nd\u00fc.<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

\u015eimdi ba\u015fka \u00fcr\u00fcnler ekleyerek asl\u0131nda negatife d\u00f6nm\u00fc\u015f olan bakiyeyi pozitife \u00e7ekebilirim. \u015eu an bakiye -20711351.96 ve 13.83 dolara High-End Gift Wrapping almak istersem yakla\u015f\u0131k pozitif yapabilmek i\u00e7in 149756702 tane almam laz\u0131m. Bu da 99 tane istek i\u00e7in 1512693 adet ediyor. Buna sahip bir for d\u00f6ng\u00fcs\u00fc kurdum a\u015fa\u011f\u0131daki gibi.<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

Birka\u00e7 hatal\u0131 i\u015flemden sonra b\u00fct\u00fcn sald\u0131r\u0131ya en ba\u015ftan ba\u015flamak gerekti ama sonunda g\u00f6rd\u00fc\u011f\u00fcn\u00fcz gibi 0.55 dolara al\u0131nabilecek hale getirdim.<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

Ve lab \u00e7\u00f6z\u00fcld\u00fc.<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"

Bu labda, PortSwigger Web Security Academy\u2019nin Business Logic kategorisindeki \u201cLow-level logic flaw\u201d senaryosunu inceliyoruz. Sepete \u00fcr\u00fcn eklerken uygulanan adet s\u0131n\u0131r\u0131na ra\u011fmen ayn\u0131 iste\u011fin tekrar g\u00f6nderilebilmesi,…<\/p>\n

Devam\u0131n\u0131 okuPortSwigger Business Logic Lab 5: Low-level Logic Flaw<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[753],"class_list":["post-2716","post","type-post","status-publish","format-standard","hentry","category-web","tag-business-logic","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2716"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2716\/revisions"}],"predecessor-version":[{"id":2730,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2716\/revisions\/2730"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}