Plant a logic flaw a scanner cannot see

short · 50 min · Objective 3.1

Task

Put two weaknesses on a lab host — one a known-signature issue a scanner will find, one a logic flaw it structurally cannot — then scan it and prove the gap. This is the difference between a scan and a test, made concrete.

Steps

  1. On the lab network you own, run a small web application you can edit.
  2. Plant a signature-detectable issue: run a component with a known vulnerable version, or leave a recognised misconfiguration in place.
  3. Plant a logic flaw: make the application trust a client-supplied value it should not — an order total taken from the request, or an identifier that can be changed to read another user's record.
  4. Run a vulnerability scanner against it and save output to /tmp/scan.txt.
  5. Confirm the scanner found the signature issue and did NOT find the logic flaw.
  6. Write /tmp/gap.md: what the scan reported, what it missed, and why no signature exists for the logic flaw.

Verify

grep -ciE "version|outdated|CVE|misconfigur" /tmp/scan.txt
grep -ciE "logic|business|idor|price|authoriz" /tmp/scan.txt
grep -ciE "cannot|no signature|logic flaw|structural" /tmp/gap.md

The first count must be non-zero: the scanner found the signature issue. The second must be zero or near it: the scanner did not report the logic flaw, because it has no pattern for something the application does exactly as built. The third must be non-zero: your write-up names why the gap exists. That gap is the value of a human test over a scan.

Notes

A scanner recognises known patterns; a logic flaw is the application correctly doing the wrong thing, unique to that application, with no signature. Chained findings are the same blind spot — two mediums that together give full compromise are reported as two mediums, because a scanner judges findings individually. A clean scan is a bounded statement, and the report must bound it. Everything here ran against a host you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.