when i open a new program, i don't start running tools. i start understanding what the app does.
i sign up, create an account, and use it like a normal user. burp is capturing everything in the background, but i'm not looking at burp yet — i'm looking at the app.
what i'm looking for:
where are the IDs? — every time i see a number or uuid in a url, a request, a response, i take note. /api/org/123/members — that's getting tested later.
what's the permission model? — roles? admin/member/viewer? orgs, teams, projects? the more layers, the higher the chance someone forgot a check somewhere.
what's "mine" vs "theirs"? — if i can see my profile at /users/me, does /users/123 exist? if i can list my projects, can i list another org's?
features that look new — changelogs, product blogs, "new!" badges in the UI. new feature = new code = less tested.
features that look forgotten — export, webhook config, api keys page, advanced settings. nobody tests what nobody uses.
integrations — oauth, webhooks, api tokens, sso. every integration is a new attack surface with its own auth.
after 30 minutes i have a mental list of where to attack. then i open burp, look at the sitemap, and go endpoint by endpoint.
here's the thing most people miss though: don't just test the endpoints you see. read the javascript. apps ship their entire api client in the bundle — routes the UI doesn't use yet, admin endpoints behind feature flags, internal debug paths that never got removed. some of the best bugs i've found were in endpoints hidden in js bundles, not in anything the UI actually exposes. while you're in there, check for an exposed api schema too — /swagger.json, /openapi.json, /api-docs — if one's public it hands you every route and parameter at once.
pull every js file. search for /api/, fetch(, axios., endpoint, admin, internal. build a list of every route the app knows about, not just the ones it shows you. then test those with your low-priv account. that gap — between what the frontend knows and what the frontend shows — is where the best bugs live.
the bugs i'm proudest of didn't come from automated scanning. they came from understanding the app better than whoever tested it before me.