[serwking]

The site I'm trying to do this on has a HMAC system and apparently the hmac parameters including the key, salt and the inputs are accesible on the website through an exploit.

What's the best way to find such a vulnerability?

[hunter24957]

Use Acunetix, it'll scan the website for every possible vulnerability.