Just find points of interest and reverse the flow back to find if there is something in the environment you can manipulate to your will alter the poi.
Eg, if you find a
memcpy(a, b, c); check where b and c are coming from, are they from user generated input or system generated input, maybe they are statics.
If it they are generated from user input you can manipulate the flow of the program as you can copy arbitrary data into the memory. This might allow you to alter the stack and thus alter the flow of the program.
Leading into a security vulnerability.