Business logic is best understood through a discovery of what the application itself is trying to do, assessing expected behavior, and then looking for ways in which that expected behavior falls apart. Some of these issues may in fact be due to an issue with the software, or a misconfiguration of the modules supporting the application. While the line is blurry at times, we're going to focus on behavioral flaws that are better uncovered with insight into the application's purpose, the company's objectives, and the processes that the target's developers believe they were delivering.
So, how does OWASP define these vulnerabilities? In actuality, these flaws are less straightforward than the others we have looked at together so far. They are also often categorized improperly, but our major concern should be the integrity of the application...