There are plenty of "holes" in the pservers. The base thing that you need is to use "brain" and logical thinking imo
you should look into as3, or try to discover general exploits for example, duping. Use some dupes that were around on prod on private servers
it works 9/10 times