The membrane likely slips into some header on the controller. The header connector in turn has one metal contact point per membrane trace. You should be able to connect all possible pairs of these contact points to generate all keystrokes, since that's what the membrane is supposed to do: connect two wires/traces/leads together to actuate a keystroke.
Suppose there are 20 contact points/pins/leads/traces/solder blobs at the connector, and it's soldered onto the controller PCB. I'm grossly abusing terms here as you can see.
While
AquaKeyTest is running, do the following:
Take one end of a wire, place it on pin 1.
Then "sweep" the other end of the wire, contacting it on each pin from 2 to 20.
Repeat this for each successive pin:
Put one end of that wire on pin 2, and sweep across 3 to 20.
You don't have to sweep 19 per pin because a previous sweep would've tested that pair...
On a normal keyboard, you should be able to fully "light up" Aqua's Key Test.
Beware however, if your keyboard supports extra keys such as those nifty ones which will either shutdown or put a Windows machine in standby...
Take note of these pin combinations and avoid them until you complete the sweeps.