| name | exploit-chaining |
| description | Combine low/medium findings into one high-impact exploit chain, and amplify demonstrated impact. Load when you have several small bugs, a "so what?" finding, on "chain", "escalate impact", or building the narrative for a report. Signals: self-XSS + CSRF, open-redirect + OAuth, IDOR + info-leak, SSRF + metadata.
|
| domain | exploit-dev |
| type | methodology |
| stability | learning |
| modes | ["pentest","bugbounty"] |
| severity | high |
| schema_version | 1 |
| tools | [] |
Exploit chaining & impact amplification
When it applies
You have bugs that are individually "meh" (self-XSS, an info leak, an open redirect, a weak
CSRF) and need to turn them into something a program pays for — or a pentest foothold that needs
several bugs stacked.
Why it works
Impact is compositional. One bug supplies a precondition another needs: a leak provides the id
IDOR needs; an open redirect makes OAuth leak a token; SSRF reaches the metadata service that
yields cloud creds. The chain's severity is the end impact, not the weakest link.
Method
- Inventory every finding with what it gives and what it needs (primitive in / out).
- Look for matches: does bug A's output satisfy bug B's precondition? Common chains:
- self-XSS + login-CSRF / cookie-fixation → land XSS in the victim's session.
- open redirect + OAuth
redirect_uri → steal the authorization code → ATO.
- IDOR/info-leak → user id/UUID → BOLA on another endpoint.
- SSRF →
cloud-imds-ssrf → IAM creds → cloud impact.
- file upload (stored) → XSS/SSRF/RCE depending on how it's served.
- Build the shortest reliable path to the highest impact; script the PoC end-to-end.
- Write the narrative: state the end impact first, then each link with its role, so a
triager sees severity immediately (see
reporting-bug-bounty-writeup).
Gotchas
- Don't over-chain — the simplest path to real impact is more credible and reproducible.
- Each link must be reliable; a flaky step sinks the whole chain in triage.
- Keep every step in scope and within RoE — a chain that steps out of scope is unreportable.
Verify success
A single reproducible PoC that starts from attacker-controlled input and ends at concrete
high impact (ATO, data access, RCE, cloud takeover).
References
Bug-bounty disclosed chains (HackerOne Hacktivity); PortSwigger chained-attack labs.
