🏴‍☠️ Featured Security Experiment

FlowBusters

FlowBusters is an experimental proof of concept for discovering business-logic flaws from one recorded browser workflow.

“The lock was only painted.”

View GitHub Repo → See the Workflow Read the Tall Tale

A short walkthrough of FlowBusters in action.

What It Does

FlowBusters records a legitimate workflow in a headed Chromium browser, captures the related HTTP traffic, analyzes state transitions, generates adversarial business-logic tests, executes HTTP probes against an authorized target, and produces evidence-backed findings.

The goal is to test whether the application enforces its workflow rules on the server — not merely whether the expected user interface behaves correctly.

Record → Analyze → Mutate → Probe → Report

🎥 Record Real browser flow demo.json + HAR 🔍 Analyze Requests + roles state_map.json 🧨 Mutate Adversarial tests generated probes 🔎 Probe HTTP tests results 📜 Report findings.json + remediation.md

Assessment Artifacts

01 / Record

demo.json

The recorded browser workflow and interaction sequence.

02 / Capture

recording.har

HTTP traffic observed while the legitimate workflow was performed.

03 / Map

state_map.json

Inferred workflow states, transitions, roles, and important endpoints.

04 / Report

findings.json

Probe outcomes, evidence, classifications, and remediation notes.

Attack Ideas

Skip Step

Bypass a required workflow prerequisite and call a later endpoint directly.

Role Swap

Use one role’s session context against another role’s expected action.

Data Tamper

Change identifiers, amounts, statuses, or ownership-sensitive values.

Mass Assignment

Submit privileged fields that are hidden or unavailable in the UI.

Double Spend

Repeat an operation sequentially or concurrently when it should be one-time.

Forced Browsing

Call a workflow endpoint without following the intended browser flow.

🏴‍☠️ A Tall Tale of the FlowShip

It was the year of our Captain, 1719, when a small crew of very serious software engineers sailed aboard the FlowShip and discovered that locks on the web are mostly for show.

The Recorder walked the ship end to end and wrote every request down. The Analyst spread the leather book across the table and drew a map of the ship’s hold: which crates could only be opened by the foreman, which by the captain, which by no one.

“A lock that only the honest obey is not a lock at all. The lock was only painted!”

Quickstart Concept

Start assessment
→ perform an authorized workflow in Chromium
→ select “Finish recording”
→ review generated tests and findings

Important

FlowBusters is an experimental MVP and is not production-ready. Use it only against non-production systems that you own or have explicit permission to test.

Generated probes may produce false positives or invalid assumptions. Findings require human review. HAR files, tokens, scripts, and reports must be treated as sensitive data.