A repeatable methodology

Finding vulnerabilities is less about luck and more about a process you repeat on every target. The bugs change; the loop doesn’t.

The loop

1. Map the attack surface — every host, endpoint, and input. (See recon.)
2. Understand the app — what it does, who the users are, where trust boundaries sit (auth, roles, payment, data ownership).
3. Hypothesize — for each input and boundary, ask “what does the developer assume here, and what happens if I break that assumption?”
4. Test one assumption at a time and compare responses.
5. Escalate — chain small flaws into real impact.
6. Document as you go.

Where bugs live

Most web vulnerabilities fall into a few buckets:

• Broken access control — missing ownership/role checks (see IDOR).
• Injection — input interpreted as code (see SQL injection).
• Authentication & session flaws — weak resets, token handling, MFA gaps.
• Business-logic flaws — abusing valid features in unintended sequences.