Skip to main content
availability

Package: Invicti AppSec Core (on-demand)

Configure target business logic sequences

Add business logic sequences so your scanner can reliably test multi-step workflows and find vulnerabilities in authenticated transaction flows. This document explains how to record and upload sequence files using the Business Logic Recorder on the target's Scan configuration tab.

Why this matters​

Many web applications use multi-step workflows - shopping carts, account sign-ups, airline reservations, rental forms - where each step depends on specific input from the previous step. Standard scanners often fail on these flows because they guess invalid field values, causing the form to bounce back to the start. When the scanner can't progress through early steps, it never reaches the later, often more security-sensitive parts of the workflow. Business logic sequences solve this by recording the exact inputs and clicks a real user makes, so the scanner can replay the path reliably and find vulnerabilities behind multi-step forms.

Identify scenarios that need business logic sequences​

Record a business logic sequence when your target includes:

  • Shopping carts or e-commerce flows - multiple pages where cart content and checkout steps depend on prior selections
  • User registration or onboarding - multi-page sign-ups where later fields depend on earlier answers
  • Conditional workflows - flows where different input values unlock different paths (for example, a rental form that shows insurance options only for certain age ranges)
  • Authenticated transactions - processes that require successful navigation through login or account setup to reach sensitive features

Different input values can trigger different workflow paths. A business logic sequence ensures the scanner can test all variations. For example, a car rental form might use a birth date field to determine eligibility:

  • Ages 20 or younger, or 65 and over - rental unavailable, process stops
  • Ages 26 to 64 - proceeds normally
  • Ages 21 to 25 - adds an extra step for insurance acknowledgment

Without recording these sequences, the scanner might guess invalid values and miss the conditional paths that contain vulnerabilities.

Add a new business logic sequence​

To get started, navigate to Inventory > Targets from the left-side menu, select your target, then open Scan configuration. Locate the Business Logic Recorder section.

Use New sequence when you need to define a fresh workflow for this target.

  1. From the Business Logic Recorder section, select New sequence.

  2. A popup window opens with the Business Logic Recorder. The Record button is pre-selected.

  3. Navigate to the first step of the workflow you want to record (for example, login, shopping cart page, or account creation form).

  4. In the recorder interface, click and interact with the form fields and buttons as a real user would:

    • Fill in text fields
    • Select dropdown options
    • Click checkboxes and radio buttons
    • Submit the form

    As you click, the right panel updates with a list of recorded actions.

  5. Continue through each step of the multi-step workflow until you reach the final step or the point where the scanner should begin testing.

  6. Select Record again to stop recording.

  7. Select Play to review the recorded sequence and verify it matches the workflow you intended.

  8. Click Save to store the recorded sequence. The platform creates a .blr file and attaches it to the target.

  9. Click Save target configuration to finalize the changes.

Reuse a sequence from another target​

Use Upload sequence when you already have a recorded sequence file (.blr file) from another target or a prior recording.

  • Select Upload sequence.
  • Choose the sequence file from your local machine.
  • Save changes with Save target configuration.

Use this option when a tested sequence already exists and you want to reuse it on this target.

Troubleshooting​

The Business Logic Recorder window doesn't open or takes a long time to open

The recorder window can take up to about 30 seconds to open, especially for targets using an internal scanning agent. The agent picks up the recording job on its next polling cycle (default: 30 seconds). If the window still hasn't opened after a minute:

  • Confirm the internal scanning agent is running and shows as connected under Scans > DAST agents.
  • Check the agent's agent.yaml configuration file to verify agent_token, auth_token, and url are current. An expired or revoked token prevents the agent from polling.
  • Verify the poll_frequency in agent.yaml has a reasonable value. The default is 30 seconds; anything higher than a few minutes can make the recorder appear stuck. To open the recorder more quickly, lower the value (for example, poll_frequency: 10s), then restart the internal agent service for the change to take effect. The agent.yaml file is located in your agent's installation directory (the folder you created when installing the agent).
The uploaded sequence doesn't affect scan coverage

Confirm the sequence was successfully attached to this target and you clicked Save target configuration. Then verify the recorded flow still matches current UI paths and form behavior.

Recorded steps fail after a recent application update

Re-record the sequence using New sequence so selectors and route transitions match the current application state.

"BLR session timed out" or "An error occurred during the Business Logic Recording session"

The connection between the browser, the platform, and the internal scanning agent dropped. Close the recorder and try again. If the error repeats:

  • Confirm the agent is still running and connected.
  • Confirm the network hasn't changed mid-recording (for example, switching from office Wi-Fi to a VPN).
  • For long sequences, finish and save the recording in segments rather than leaving the recorder idle for extended periods.

Need help?​

Invicti Support team is ready to provide you with technical help. Go to Help Center

Was this page useful?