Security issues are becoming harder to detect or exploit, especially in well audited targets. Instead of subverting the code flow, an attacker might try to subvert the application logic. This class of vulnerabilities is commonly referred to as business logic vulnerabilities. In this session, we will present the result of a research study where the author manually reviewed about 300 publicly disclosed vulnerability reports and tried to classify and cluster discovered vulnerabilities into a few categories that can be used to secure business logic issues in applications. So let's take a ride through some real life cases and examples on how to manipulate calculation, assumptions, processes, branching, logical and time based TOCTOU and other fun cases on how to break an modern application.