Yes that’s correct. Typically there’s is a “flag” or a string of text that the hackers attempt to find.

Good companies have a bug bounty program where people can submit 0-days.