Often you don't have to guess, just use how the software responds as an oracle.