| name | cross-attack-chains |
| description | Use when two or more verified findings may combine into a higher-impact authorized attack path. |
| version | 2.0.0 |
| license | MIT |
| platforms | ["any"] |
| compatibility | Requires evidence from the owning validation skills |
| tags | ["chains","attack-path","validation","reporting"] |
| category | chains |
| related_skills | ["attack-patterns-reference","evidence-hygiene","report-writing","triage-validation","wordpress-full-compromise"] |
Cross-Attack Chains
An attack chain is a sequence of verified security behaviors in which each step
provides a prerequisite for the next. Several findings on the same target do
not form a chain unless the dependency between them is demonstrated.
When to Use
- Two or more validated findings affect the same trust boundary.
- One finding exposes an identity, token, route, host, or capability needed by
another.
- A report needs to distinguish standalone impact from compound impact.
- The next chain step cannot be tested safely and must be labeled inferred.
Prerequisites
- Captured evidence and negative controls for every component finding.
- Current authorization for the compound test and any increased side effects.
- Approved identities, synthetic records, callbacks, and cleanup procedure.
- A clear stop condition for sensitive data, availability, or scope changes.
How to Run
Create a chain record beneath the target output directory:
TARGET_ID="example-test"
OUTPUT_DIR="${OUTPUT_DIR:-./output}"
CHAIN_DIR="$OUTPUT_DIR/$TARGET_ID/chains"
mkdir -p "$CHAIN_DIR"
touch "$CHAIN_DIR/EXPLOIT_CHAINS.md"
Use evidence states consistently:
| State | Meaning |
|---|
| Observed | Present in captured output |
| Confirmed | Security impact reproduced with a control |
| Inferred | Plausible dependency that has not been tested |
| Not tested | Excluded by scope, safety, or missing prerequisites |
Procedure
1. Normalize Component Findings
For each component, record:
- expected and observed behavior;
- target, identity, and timestamp;
- positive evidence and negative control;
- side effects and cleanup;
- demonstrated impact;
- assumptions and testing limits.
Discard scanner labels and version-only leads that have not passed their owning
skill's verification.
