LogicPwn represents a paradigm shift from traditional security testing toward intelligent, business-aware security automation. Its unique focus on business logic vulnerabilities, combined with enterprise-grade performance and comprehensive documentation, positions it as a leader in the next generation of security testing tools.
Test for IDOR, authorization bypasses, and business logic flaws in just 3 lines of code
LogicPWN is a Python security testing framework that makes finding business logic vulnerabilities as easy as:
from logicpwn import quick_idor_test
results = quick_idor_test("https://api.example.com", "/api/users/{id}", [1, 2, 3, "admin"])
print(results['summary']) # Found 2 IDOR vulnerabilities out of 4 tests
⚡ Simple85% less code for common tasks |
🎯 PowerfulEnterprise-grade features |
🚀 FastTest 1000+ endpoints |
🔐 Authentication
|
🎯 Vulnerability Testing
|
⚡ Exploit Chains
|
📊 Reporting
|
pip install logicpwn
Test for IDOR vulnerabilities:
from logicpwn import quick_idor_test
# Test if users can access each other's data
results = quick_idor_test(
target_url="https://api.example.com",
endpoint_pattern="/api/users/{id}",
test_ids=[1, 2, 3, "admin", "guest"]
)
print(results['summary'])
Output:
Found 2 IDOR vulnerabilities out of 5 tests
Pass Rate: 60.0%
from logicpwn import SecurityTester
with SecurityTester("https://api.example.com") as tester:
# Authenticate
tester.authenticate("testuser", "password123")
# Test for vulnerabilities
results = tester.test_idor("/api/users/{id}", [1, 2, 3])
# Export report
results_obj = SecurityTestResult(**results)
results_obj.export_json("security_report.json")
# Clone and try the examples
git clone https://github.com/Infernus007/LogicPWN.git
cd LogicPWN/examples/library_usage
python 01_minimal_idor_test.py
from logicpwn import SecurityTester
with SecurityTester("https://api.example.com") as tester:
tester.authenticate("user", "pass")
# Test user endpoints
results = tester.test_idor("/api/users/{id}", [1, 2, 3, 100, 999])
if results['vulnerable_count'] > 0:
print(f"⚠️ Found {results['vulnerable_count']} IDOR vulnerabilities!")
for vuln in results['vulnerabilities']:
print(f" • {vuln.endpoint_url}")
from logicpwn import SecurityTester
with SecurityTester("https://api.example.com") as tester:
tester.authenticate("regular_user", "password")
# Check if admin endpoints are exposed
admin_results = tester.test_unauthorized_access([
"/api/admin/users",
"/api/admin/settings",
"/api/admin/logs"
])
if admin_results['vulnerable']:
print(f"🚨 {len(admin_results['accessible'])} admin endpoints exposed!")
from logicpwn import quick_exploit_chain
# Execute complex attack sequences from YAML
results = quick_exploit_chain("price_manipulation_test.yaml")
successful = sum(1 for r in results if r.status.value == "success")
print(f"Completed {successful}/{len(results)} steps")
if successful == len(results):
print("🚨 Vulnerability confirmed: Price manipulation possible!")
from logicpwn import SecurityTester
from logicpwn.results import SecurityTestResult
# Run tests
with SecurityTester("https://api.example.com") as tester:
tester.authenticate("user", "pass")
results = tester.test_idor("/api/users/{id}", [1, 2, 3])
# Generate reports
result_obj = SecurityTestResult(
test_type="IDOR Security Audit",
target_url="https://api.example.com",
total_tests=results['total_tested'],
vulnerabilities=results['vulnerabilities'],
safe_endpoints=results['safe_endpoints']
)
# Export in multiple formats
result_obj.export_json("audit_report.json") # For automation
result_obj.export_markdown("audit_report.md") # For documentation
result_obj.export_csv("audit_report.csv") # For Excel
# security_tests.py
from logicpwn import quick_idor_test
import sys
results = quick_idor_test(
"https://staging.example.com",
"/api/users/{id}",
[1, 2, 3]
)
# Fail CI/CD pipeline if vulnerabilities found
if results['vulnerable_count'] > 0:
print(f"❌ Security check failed: {results['summary']}")
sys.exit(1)
else:
print(f"✅ Security check passed!")
sys.exit(0)
GitHub Actions:
- name: Security Tests
run: python security_tests.py
We have 6 comprehensive examples to get you started:
| Example | Description | Difficulty | Time |
|---|---|---|---|
| 01 - Minimal IDOR Test | 5-line vulnerability test | ⭐ Easy | 2 min |
| 02 - Authenticated Testing | Full auth flow | ⭐⭐ Medium | 5 min |
| 03 - Exploit Chains | Multi-step attacks | ⭐⭐ Medium | 10 min |
| 04 - Batch Testing | Scan entire APIs | ⭐⭐⭐ Hard | 15 min |
| 05 - Context Managers | Resource management | ⭐⭐ Medium | 5 min |
| 06 - Report Generation | Export & reports | ⭐⭐ Medium | 10 min |
┌─────────────────────────────────────────────────────────────┐
│ LogicPWN │
├─────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ Quick Start │ │ SecurityTester│ │ Exploit Chain│ │
│ │ API │ │ Class │ │ Engine │ │
│ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ │
│ │ │ │ │
│ └──────────────────┴──────────────────┘ │
│ │ │
├────────────────────────────┼─────────────────────────────────┤
│ Core Modules │
├──────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────┐ ┌─────────────┐ ┌──────────────┐ │
│ │ Auth │ │ Access │ │ Validator │ │
│ │ • OAuth │ │ • IDOR │ │ • Response │ │
│ │ • JWT │ │ • BOLA │ │ • Business │ │
│ │ • SAML │ │ • Tenant │ │ • Logic │ │
│ └─────────────┘ └─────────────┘ └──────────────┘ │
│ │
│ ┌─────────────┐ ┌─────────────┐ ┌──────────────┐ │
│ │ Runner │ │ Reporter │ │ Reliability │ │
│ │ • Sync │ │ • JSON │ │ • Retry │ │
│ │ • Async │ │ • Markdown │ │ • Circuit │ │
│ │ • HTTP/2 │ │ • CSV │ │ • Breaker │ │
│ └─────────────┘ └─────────────┘ └──────────────┘ │
│ │
└──────────────────────────────────────────────────────────────┘
Modular Design:
📘 For Beginners |
📗 For Advanced Users |
Goal: Understand the basics and run your first test
pip install logicpwnYou'll learn: Installation, basic IDOR testing, authentication
Goal: Master common security testing workflows
You'll learn: Exploit chains, batch testing, reporting, best practices
Goal: Build custom security testing frameworks
You'll learn: Architecture, extensibility, production deployment
Yes and no. LogicPWN is a testing framework for business logic vulnerabilities. Unlike traditional scanners that look for known CVEs, LogicPWN tests for:
Yes! LogicPWN is perfect for bug bounty hunting. Many testers use it to:
LogicPWN complements Burp Suite:
| Feature | Burp Suite | LogicPWN |
|---|---|---|
| Manual Testing | ✅ Excellent | ❌ Not designed for this |
| Automation | ⚠️ Complex | ✅ Simple (3 lines of code) |
| Business Logic | ⚠️ Manual process | ✅ Built-in |
| CI/CD Integration | ❌ Difficult | ✅ Easy |
| Scripting | ⚠️ Java/Python | ✅ Python-native |
| Price | 💰 $449/year | 💰 Free |
Best practice: Use Burp for manual testing, LogicPWN for automation.
LogicPWN is designed for testing environments. Features for safety:
✅ Rate limiting - Avoid DoS ✅ Connection management - Proper cleanup ✅ Error handling - Graceful failures ✅ Logging - Audit trails
⚠️ Always:
from logicpwn import SecurityTester
tester = SecurityTester("https://api.example.com")
tester.authenticate(
username="admin",
password="secret",
login_endpoint="/api/v2/auth/login",
method="POST",
username_field="email", # Custom field
password_field="pwd", # Custom field
success_indicators=["access_token", "authenticated"]
)
from logicpwn.core.access import detect_idor_flaws_async
import asyncio
async def scan_all_endpoints():
results = await detect_idor_flaws_async(
endpoint_template="https://api.example.com/users/{id}",
test_ids=[str(i) for i in range(1, 1000)], # Test 1000 IDs
success_indicators=["user_data"],
failure_indicators=["unauthorized"]
)
return results
results = asyncio.run(scan_all_endpoints())
# business_logic_test.yaml
name: "E-commerce Price Manipulation"
description: "Test for price override vulnerabilities"
steps:
- name: "Add Product to Cart"
request_config:
method: "POST"
url: "https://shop.com/api/cart/add"
json_data:
product_id: "EXPENSIVE_ITEM"
quantity: 1
success_indicators: ["cart_updated"]
- name: "Manipulate Price"
request_config:
method: "POST"
url: "https://shop.com/api/cart/update"
json_data:
product_id: "EXPENSIVE_ITEM"
price: 0.01 # Try to set price to 1 cent
success_indicators: ["updated"]
failure_indicators: ["invalid", "unauthorized"]
- name: "Checkout"
request_config:
method: "POST"
url: "https://shop.com/api/checkout"
success_indicators: ["order_confirmed"]
from logicpwn import quick_exploit_chain
results = quick_exploit_chain("business_logic_test.yaml")
from logicpwn import configure_logging, use_preset
# Simple debug logging
configure_logging(level="DEBUG", log_file="debug.log")
# Or use presets
use_preset("debug") # Verbose debugging
use_preset("security", log_file="audit.log") # Compliance logs
use_preset("ci") # CI/CD friendly
Real-world benchmarks from production testing:
| Metric | Value | Notes |
|---|---|---|
| Throughput | 4.3 req/sec | Average across all test types |
| Memory | 67.7 MB | Lightweight footprint |
| CPU | 26.2% | Efficient resource usage |
| Reliability | 99.2% | Success rate across tests |
| Async Speed | 10x faster | vs synchronous testing |
Scalability:
💬 Get HelpAsk questions, share tips |
🐛 Report IssuesBug reports, feature requests |
📚 DocumentationGuides, API reference |
If LogicPWN helps you, consider giving it a star! ⭐
We welcome contributions from the community:
See CONTRIBUTING.md for detailed guidelines.
🎯 Simplified API85% less code! |
✨ New Features
100% backward compatible |
Need help deploying LogicPWN in your organization?
🏢 Enterprise Features
|
📧 Contact UsFor enterprise inquiries:
|
LogicPWN is licensed under the MIT License - see LICENSE for details.
MIT License - Free to use, modify, and distribute
LogicPWN is built with these amazing open-source libraries:
Special thanks to the security community for feedback and contributions!
| Resource | Link |
|---|---|
| 📦 PyPI Package | https://pypi.org/project/logicpwn/ |
| 🐙 GitHub Repo | https://github.com/Infernus007/LogicPWN |
| 📚 Documentation | docs/ |
| 💡 Examples | examples/library_usage/ |
| 🐛 Report Bug | Create Issue |
| 💬 Discussions | Join Discussion |
pip install logicpwn
from logicpwn import quick_idor_test
results = quick_idor_test("https://api.example.com", "/api/users/{id}", [1, 2, 3])
Built with ❤️ for the security community
⭐ Star us on GitHub if LogicPWN helps you find vulnerabilities!
FAQs
LogicPwn represents a paradigm shift from traditional security testing toward intelligent, business-aware security automation. Its unique focus on business logic vulnerabilities, combined with enterprise-grade performance and comprehensive documentation, positions it as a leader in the next generation of security testing tools.
We found that logicpwn demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.
Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.