You can assume a desired end state and try and brute force it finding a security bug.