Information Security training is often taught using common toolsets and how to interpret the output. The majority of Web application findings are not caught by common toolsets in use today. This talk is targeted at new to mid-level penetration testers and will show examples of real world programming logic failures and how to exploit them.