Complex, multi-stage engagements

Hard targets differ in kind, not just difficulty. The path is usually a chain of 2–4 bugs wrapped in deliberate dead-ends — sometimes needing source review, custom exploit work, reversing, or a crypto attack — and it often spans multiple hosts and sessions. Wins come from disciplined enumeration and ruthless dead-end tracking, not a bigger exploit. In-scope, authorized targets only (see tradecraft-scope-roe).

Keep a working record (per engagement)

engagement/
  state.md          # live status + a "haven't tried yet" list
  deadends.md       # ruled-out leads WITH the reason each was dropped   ← the key habit
  chains/           # working exploit chains / PoC drafts, one link at a time
  findings/         # confirmed findings + evidence
  hosts/<host>/     # one subdir per internal host reached