In pen testing applications, so far we have been quite methodical in how we approach each technique used here. Automated tools such as our proxy scanners, brute-force applications, and the many enumeration and scanning tools have helped assist with that and could feasibly enable a newer pen tester to successfully identify many vulnerabilities without intimate knowledge of the environment. This is because many of those tests related to improper coding, technical flaws, or misconfigurations, and they were much more tangible in nature.
Business logic testing, however, is all about understanding the workflow the site is trying to articulate or execute. Now, we still may be employing tools, but only after they have been directed with hands-on knowledge. In many cases, the work to adapt a tool to a specific business logic test may far exceed the time to conduct...