07. Game Plan

Knowing bug classes is half of it. The other half is having a process you can run on any app, every time, without getting lost.

The Loop

1. Be a user first Sign up, click every button, fill out every form. You can't spot weird behavior until you know what normal looks like.
2. Build a map With Burp or the Network tab running, write down every page, API call, and parameter you see. Then go digging: page source, JS files, robots.txt.
3. Follow your input Pick a parameter and figure out where it lands. A database query? A shell command? Back on the page? Used to look up a record? That tells you which bug to hunt for.
4. Poke it Send small, harmless probes and compare responses. An error, a missing chunk of page, or a different result count is a lead.
5. Prove it Once something looks off, slow down and work out exactly why. Build a payload for that specific spot instead of pasting a list and hoping.
6. Write it down, move on Save the request, the steps, and the impact. Most leads go nowhere, and that's normal. The people who find bugs are the ones who keep looping.

Cheat Sheet

Where to go next