[rmc]

In order to find the vulnerbility you almost certainly have to try it out. Even for an XSS, you'd have to make a JS alert box popup for yourself. And then you've technically broken the law, since you hacked the website.