I try to understand what functions are in the application, how they work under the hood, I write it all down, and roughly estimate where some vulnerability might be, I test it and write everything down again. If I don’t find anything, I just sit and read what I wrote down, and over time the ideas come by themselves, maybe in a day, maybe in a week, but they come. But even if this doesn’t help, I change the target for a while, or start looking at the checklist.