Maintain state and select the next evidence-producing test

Before interacting with a target, record

Copy# Before interacting with a target, record
scope and explicit exclusions
objective and required evidence
starting identity/credential and whether it is local, domain or application scoped
source host, interface, route and DNS context
allowed/restricted tools and the current Metasploit target decision
case directory and note/evidence locations
cleanup or restoration obligations

Create a private case workspace using target-neutral names until the real scope is known

An interesting vulnerability is not automatically the objective. The attack is complete only when the required access or privilege is verified and the reproduction/evidence chain is retained.

Copy# Create a private case workspace using target-neutral names until the real scope is known
mkdir -p case/{00-admin,01-scans,02-services,03-web,04-exploits,05-loot,06-sessions,07-screenshots,08-report}
touch case/00-admin/{scope.md,state.md,credentials.md,routes.md,hypotheses.md,transitions.md}

Client commands / example output

Do not put exam or private target material in a public repository.

Copy# Baseline
HOSTS
- host/IP | role | reachable from | open services | evidence file

IDENTITIES
- local/domain identity | credential type | validated services | privilege | source

ROUTES
- source -> listener/tunnel -> pivot -> destination | DNS point | callback path

HYPOTHESES
- observation | hypothesis | prerequisite | next discriminating test | status

TRANSITIONS
- old state -> action -> new access/identity/route | decisive output | evidence

EVIDENCE COVERAGE
- objective | reproduction complete? | identity/IP proof? | screenshot? | panel/task state

Client commands / example output

Label each claim observed, inferred, possible, confirmed, disproven or inconclusive. Close a path only with a test that addressed its prerequisite; do not confuse a tool error with a disproven attack hypothesis.

Copy# Baseline
Observe
→ Enumerate
→ Interpret
→ Hypothesize
→ Validate prerequisite
→ Exploit the confirmed primitive
→ Verify the new state
→ Re-enumerate from that state
→ Escalate, move or pivot
→ Capture evidence and cleanup

# The coverage queue prevents missed surfaces
host/source position → endpoint → confirmed application → required enumeration → state

# The hypothesis queue prevents random exploitation
observation → possible transition → prerequisite → cheapest discriminating test
→ decisive success/failure → next action

New state	Mandatory re-entry
Hostname, address, interface, listener or route	Discovery and service identification from the source position that can reach it
Credential, key, hash or ticket	Classify identity/material, validate compatible access, then authenticated enumeration
Application role/session	Revisit the same application and objects through the new authorization view
Command execution or shell	Verify host/identity/network, repair the session, transfer only what is needed, start local enumeration
Administrator/root/SYSTEM	Re-enumerate protected files, credentials, services, sessions, routes and domain context
Domain identity/group/right	Rebuild reachable host/service/object paths and validate the specific right
Pivot or proxy	Repeat discovery from the new vantage point; separately design callback and delivery routes

Create one card per distinct mechanism

Do not spend the whole assessment deepening one hypothesis while high-value coverage remains unknown. Conversely, do not keep scanning after a confirmed path only to avoid validating it.

Copy# Create one card per distinct mechanism
Observation:
Desired state transition:
Required prerequisites:
Already confirmed:
Still unknown:
Cheapest discriminating test:
Success means:
Failure means:
Noise/change/cleanup:
Handoff if successful:
Status/evidence:

1. Confirmed prerequisite, direct objective transition. Test first.
2. Strong observation, one cheap missing prerequisite. Validate next.
3. Useful information path. Prefer when it can unlock several branches.
4. Multiple unsupported assumptions or disruptive action. Defer.
5. Disproven prerequisite. Close until new evidence changes it.

Evidence strength overrides technique popularity. Prefer low-cost tests that split plausible explanations and create reusable information. A path that succeeds only after several unverified assumptions is not yet a high-priority path.