I discovered a possible vulnerability; now, how can I exploit it without raising suspicion?

I was doing some OSINT work and, while looking through public information, I came across what I suspect might be one or more vulnerabilities. I used simple tools like Shodan—to name just one—and I’d like to know how I can start pulling at these threads to see what I find. I was thinking about using Burp Suite, although I haven't quite mastered the interceptor yet. I’d appreciate it if you could share some practical tips here.