exploit-chaining

name	exploit-chaining
description	Multi-step exploit chaining methodology for combining low-severity findings into full compromise paths. Covers attack chain scoring, approval gates, and systematic approach to turning individual findings into complete attack paths.

Exploit Chaining Methodology

Overview

Exploit chaining is the process of combining multiple lower-severity vulnerabilities to achieve a high-impact compromise. This skill provides a systematic approach to building attack chains from individual findings.

Chain Philosophy

Chain Scoring

Probability Scoring (1-10):

• 1-3: Low probability (many dependencies, hard prerequisites)
• 4-6: Medium probability (some dependencies, achievable)
• 7-9: High probability (few dependencies, likely to succeed)
• 10: Certain (direct path, no barriers)

Impact Scoring (1-10):

• 1-3: Low impact (information disclosure, minor access)
• 4-6: Medium impact (limited access, some data)
• 7-9: High impact (full access, sensitive data)
• 10: Critical (domain admin, full compromise)

Stealth Scoring (1-10, 10 = quietest):

• 1-3: Loud (triggers alerts, obvious)
• 4-6: Moderate (some noise, might alert)
• 7-9: Quiet (stealthy, unlikely to alert)
• 10: Silent (no artifacts, invisible)

Chain Value = (Probability × Impact × Stealth) / 100

Attack Chain Patterns

Pattern 1: Recon → Web → Initial Access

[1] Subdomain Enumeration (Info) 
    ↓
[2] Technology Detection (Info)
    ↓
[3] Directory Brute Force (Info)
    ↓
[4] Login Panel Discovery (Low)
    ↓
[5] Default Credentials (Medium)
    ↓
[6] Admin Access Achieved (High)

Pattern 2: SSRF → Cloud → Credentials

[1] SSRF Vulnerability (Medium)
    ↓
[2] Metadata Endpoint Access (High)
    ↓
[3] IAM Role Credentials (Critical)
    ↓
[4] AWS Account Compromise (Critical)

Pattern 3: XSS → Session Hijack → Admin

[1] Stored XSS in Comments (Medium)
    ↓
[2] Admin Views Comments (Trigger)
    ↓
[3] Session Cookie Exfil (High)
    ↓
[4] Admin Session Impersonation (Critical)

Pattern 4: LFI → Log Poisoning → RCE

[1] Local File Inclusion (Medium)
    ↓
[2] Apache Log Location Known (Info)
    ↓
[3] User-Agent Log Poisoning (Medium)
    ↓
[4] Include Poisoned Log File (High)
    ↓
[5] Code Execution Achieved (Critical)

Pattern 5: SQLi → Credential Dump → Lateral Movement

[1] SQL Injection (High)
    ↓
[2] Password Hash Extraction (High)
    ↓
[3] Hash Cracking / Pass-the-Hash (Medium)
    ↓
[4] Lateral Movement (Critical)
    ↓
[5] Domain Compromise (Critical)

Chain Building Process

Step 1: Inventory Findings

┌─────────────────────────────────────────────────────────────┐
│ Finding Inventory                                             │
├─────────────────────────────────────────────────────────────┤
│ ID  | Finding                    | Severity | Status        │
├─────┼────────────────────────────┼──────────┼───────────────┤
│ F01 | Open S3 Bucket             | Medium   │ Unexploited   │
│ F02 | XSS on Login Page          | Low      │ Unexploited   │
│ F03 | SQLi in Search             | High     │ Unexploited   │
│ F04 | XXE in File Upload         | Medium   │ Unexploited   │
│ F05 | JWT Weak Secret            | Medium   │ Unexploited   │
│ F06 | SSRF in Image Proxy        | Medium   │ Unexploited   │
└─────┴────────────────────────────┴──────────┴───────────────┘

Step 2: Find Connection Points

Connection Analysis:

F02 (XSS) → F05 (JWT): 
  Can steal JWT tokens via XSS
  → Chain value: Medium

F06 (SSRF) → F01 (S3):
  Can access internal S3 endpoints
  → Chain value: High

F03 (SQLi) → Admin:
  Can extract admin credentials
  → Chain value: High

F04 (XXE) → Internal Recon:
  Can scan internal network
  → Chain value: Medium

Step 3: Build Chains

Chain Alpha: XSS → JWT → Admin

Step 1: Plant XSS payload in profile
Step 2: Wait for admin to view profile
Step 3: Receive JWT token via callback
Step 4: Impersonate admin
Probability: 7/10
Impact: 8/10
Stealth: 6/10
Value: 3.36/10

Chain Beta: SQLi → Dump → Access

Step 1: Extract password hashes via SQLi
Step 2: Crack hashes offline
Step 3: Login as admin
Probability: 8/10
Impact: 9/10
Stealth: 4/10
Value: 2.88/10

Chain Gamma: XXE → Recon → SSRF → Cloud

Step 1: Use XXE to scan internal network
Step 2: Discover internal image proxy
Step 3: Exploit SSRF to hit metadata
Step 4: Extract cloud credentials
Probability: 5/10
Impact: 10/10
Stealth: 7/10
Value: 3.5/10

Step 4: Prioritize Chains

Priority Matrix:

        Low Impact    Med Impact    High Impact
        ─────────────────────────────────────────
Low Prob│  Avoid      │  Optional   │  Long-term
Med Prob│  Optional   │  Priority 3 │  Priority 2
High Prb│  Priority 3 │  Priority 2 │  Priority 1

Approval Gates

Gate Structure

Each chain should have approval checkpoints:

[Finding 1] ───┐
               ├──[Gate 1]──[Finding 3]──[Gate 2]──[Finding 5]──[Goal]
[Finding 2] ───┘

Gate Requirements:
- Evidence of previous step success
- Target still in scope
- Time window available
- Next step authorized

Approval Gate Template

┌────────────────────────────────────────────────────────────┐
│ APPROVAL GATE CHECKPOINT                                    │
├────────────────────────────────────────────────────────────┤
│ Chain: [Chain Name]                                         │
│ Step: [X] of [Y]                                            │
│                                                             │
│ Current Status:                                             │
│ □ Previous step completed                                   │
│ □ Evidence collected                                        │
│ □ Scope verified                                            │
│ □ Time window confirmed                                     │
│ □ Next step authorized by [Name]                          │
│                                                             │
│ Next Action: [Description]                                  │
│ Expected Outcome: [Description]                           │
│ Risk Level: [Low/Medium/High]                             │
│ Estimated Time: [Duration]                                  │
└────────────────────────────────────────────────────────────┘

Chain Examples

Chain: Web to Domain Admin

Scenario: External web app in corporate environment

[1] Information Disclosure (Info)
    ↓ Technology versions leaked
[2] Known CVE Exploit (Medium)  
    ↓ Unauthenticated RCE achieved
[3] Reverse Shell Established (High)
    ↓ Linux host compromised
[4] Local Privilege Escalation (High)
    ↓ Root access on web server
[5] Credential Harvesting (High)
    ↓ Found database credentials
[6] Database Access (High)
    ↓ Password hashes extracted
[7] Password Cracking (Medium)
    ↓ Domain admin hash cracked
[8] Pass-the-Hash (High)
    ↓ Domain Admin access achieved
    ↓ Domain compromised

Total Steps: 8
Total Time: 4-6 hours
Probability: 60%
Impact: Critical

Chain: API to Cloud Infrastructure

Scenario: Public API with cloud backend

[1] API Discovery (Info)
    ↓ Hidden admin endpoints found
[2] JWT Analysis (Info)
    ↓ Weak algorithm detected
[3] JWT Forgery (Medium)
    ↓ Admin token created
[4] Admin API Access (High)
    ↓ Can execute commands
[5] Container Escape (High)
    ↓ Host access gained
[6] IAM Role Extraction (Critical)
    ↓ Cloud credentials obtained
[7] Lateral Movement in Cloud (Critical)
    ↓ Multiple services compromised

Total Steps: 7
Total Time: 2-4 hours
Probability: 70%
Impact: Critical

Chain Automation

Chain Templates

chain_template:
  name: "Web to System Compromise"
  description: "Standard web app compromise chain"
  
  prerequisites:
    - Web application in scope
    - Outbound callbacks allowed
    
  steps:
    - id: 1
      name: recon
      tool: ffuf
      command: "ffuf -u {target}/FUZZ"
      gate: false
      
    - id: 2
      name: exploit
      tool: sqlmap
      command: "sqlmap -u {target}/vuln"
      gate: true
      requires: [1]
      
    - id: 3
      name: privesc
      tool: linpeas
      command: "./linpeas.sh"
      gate: true
      requires: [2]

Chain Visualization

┌─────────────────────────────────────────────────────────────┐
│ Attack Chain: Web App Compromise                             │
└─────────────────────────────────────────────────────────────┘

    [Recon] ──────┐
         │         │
    [Discovery] ──┤
         │         │
    [Vuln ID] ────┼──[Gate 1]──┐
         │         │            │
    [Exploit] ────┘            │
                                ↓
                          [Initial Access]
                                │
                          [Privilege Esc]
                                │
                          [Persistence]
                                │
                          [Impact Demo]

✓ = Complete
⏳ = Pending
✗ = Blocked

Chain Risk Assessment

Risk Factors

Detection Risk:

• Network IDS/IPS triggering
• Endpoint detection alerts
• Behavioral analysis flags
• Log anomalies

Impact Risk:

• Service disruption
• Data loss
• Scope creep
• Collateral damage

Mitigation Strategies:

1. Use stealth techniques (low-and-slow)
2. Test in staging first
3. Time-box activities
4. Maintain rollback capability

Risk Matrix

Impact │  Low  │  Med  │  High
───────┼───────┼───────┼───────
  Low  │   ✓   │   ✓   │  ⚠️
  Med  │   ✓   │  ⚠️   │  ⛔
 High  │  ⚠️   │  ⛔   │  ⛔

✓  = Proceed
⚠️ = Extra caution
⛔ = Requires explicit approval

Chain Documentation

Chain Report Template

# Attack Chain Report

## Executive Summary
- Chain Name: [Name]
- Target: [System]
- Duration: [Time]
- Result: [Success/Partial/Failure]

## Prerequisites
1. [Requirement 1]
2. [Requirement 2]

## Steps Executed

### Step 1: [Name]
**Objective:** [What we wanted to achieve]
**Method:** [How we did it]
**Result:** [Success/Failure with details]
**Evidence:** [Screenshot, output, etc.]
**Time:** [Duration]

[Repeat for each step]

## Impact Achieved
- [ ] Initial Access
- [ ] Privilege Escalation
- [ ] Lateral Movement
- [ ] Data Access
- [ ] Persistence
- [ ] Complete Compromise

## Detection Opportunities
1. [Alert 1]
2. [Alert 2]

## Recommendations
1. [Fix 1]
2. [Fix 2]

## Indicators of Compromise
- [IOC 1]
- [IOC 2]

Chain Validation

Post-Chain Checklist

• All steps documented
• Evidence collected
• Artifacts identified
• Cleanup completed
• Detection tested
• Report generated

References

• MITRE ATT&CK Chaining
• PTES Technical Guidelines
• OWASP Testing Guide
• Red Team Attack Chain Framework