# Exploit Chain Construction

> Methodology for constructing exploit chains from individual findings — combining low/medium vulnerabilities into critical attack paths. Use when performing threat modeling, reviewing the aggregate risk of multiple findings in a single codebase, escalating severity through vulnerability chaining, or training the attacker mindset needed for elite security review. Covers real-world chain examples (SSRF→metadata→creds, prototype pollution→gadget→RCE, IDOR→CSRF→account takeover, open redirect→OAuth→token theft), chain construction methodology, and severity escalation rules.

- Skill: `nickgallick/exploit-chain-construction` (Agent Skill)
- Install (CLI): `npx skillmds add nickgallick/exploit-chain-construction`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nickgallick/exploit-chain-construction/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: nickgallick (https://skillmd.com/u/nickgallick)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/nickgallick/exploit-chain-construction

---


# Exploit Chain Construction

## The Key Insight

**Vulnerability scanners find individual issues. Elite reviewers find chains.**

A "Medium" directory traversal + a "Low" information disclosure + a "Medium" SSRF = **Critical RCE with data exfiltration.** The individual findings are unremarkable. The chain is devastating.

This is the difference between a B-tier and S-tier security reviewer.

## Chain Construction Methodology

### Step 1: Map All Findings
After reviewing a codebase, list every finding regardless of severity:
- Information disclosures (error messages, stack traces, version leaks)
- Input validation gaps (missing sanitization, type coercion)
- Access control weaknesses (missing auth, IDOR, CSRF)
- Configuration issues (verbose errors, debug endpoints, permissive CORS)
- Injection points (XSS, SQLi, SSRF, command injection)
- Logic flaws (race conditions, state violations, missing checks)

### Step 2: Build the Attack Graph
For each finding, ask:
1. **What can the attacker learn or obtain from exploiting this?** (tokens, IDs, internal URLs, error details)
2. **What does each other vulnerability NEED as input?** (valid session, user ID, internal URL, specific parameter)
3. **Draw arrows**: Finding A produces X → Finding B requires X → Finding B produces Y → Finding C requires Y

### Step 3: Walk the Chain
Start from the attacker's initial position (unauthenticated, external) and walk through the graph:
```
Attacker (external, no auth)
  → Exploit vuln 1: gain information/access
    → Use output as input to vuln 2: escalate
      → Use output as input to vuln 3: achieve objective
```

### Step 4: Assess Chain Severity
The chain's severity = **the impact of the final step**, not the average of individual findings.

| Chain Result | Severity |
|-------------|----------|
| Full RCE | CRITICAL |
| Account takeover | CRITICAL |
| Complete data exfiltration | CRITICAL |
| Admin access | CRITICAL |
| Financial manipulation | CRITICAL |
| PII exposure | HIGH |
| Partial data access | HIGH |
| DoS (service level) | MEDIUM-HIGH |
| Information disclosure only | MEDIUM |

## Real-World Chain Patterns

### Chain 1: SSRF → Cloud Metadata → Full Compromise
```
1. [MEDIUM] SSRF via Image optimization wildcard
2. [INFO] AWS metadata endpoint accessible (no IMDSv2)
3. [CRITICAL CHAIN] SSRF → fetch metadata → steal IAM creds → access S3/RDS/Lambda
```
Individual: Medium + Info = Low urgency
**Chained: CRITICAL** — complete cloud infrastructure compromise

### Chain 2: Prototype Pollution → Template Gadget → RCE
```
1. [MEDIUM] Prototype pollution via deep merge of user input
2. [INFO] EJS template engine in dependency tree
3. [CRITICAL CHAIN] Pollute outputFunctionName → EJS compilation → arbitrary code execution
```
Individual: Medium + Info (EJS is just a dependency)
**Chained: CRITICAL** — unauthenticated RCE

### Chain 3: Open Redirect → OAuth → Token Theft
```
1. [LOW] Open redirect on /callback?next=<url>
2. [INFO] OAuth flow uses redirect for token delivery
3. [HIGH CHAIN] Craft OAuth URL with redirect → user authenticates → token sent to attacker domain
```
Individual: Low + Info
**Chained: HIGH** — auth token theft, account takeover

### Chain 4: IDOR + CSRF → Account Takeover
```
1. [MEDIUM] IDOR on profile update (can update any user's email)
2. [MEDIUM] No CSRF protection on profile update endpoint
3. [CRITICAL CHAIN] Attacker hosts page → victim visits → CSRF changes victim's email → attacker resets password
```
Individual: Two mediums
**Chained: CRITICAL** — full account takeover

### Chain 5: XSS → Admin Session → Data Export
```
1. [MEDIUM] Stored XSS in user profile "bio" field
2. [INFO] Admin dashboard renders user profiles
3. [HIGH] Admin has bulk data export capability
4. [CRITICAL CHAIN] XSS in bio → admin views profile → session stolen → export all data
```

### Chain 6: Race Condition → Double Spend → Financial Loss
```
1. [MEDIUM] TOCTOU in balance check (no DB locking)
2. [LOW] No idempotency on transfer endpoint
3. [HIGH CHAIN] Concurrent requests → balance check passes N times → N transfers of full balance
```

### Chain 7: Information Leak → Targeted SSRF → Internal API → Data
```
1. [LOW] Stack trace reveals internal microservice URLs
2. [MEDIUM] SSRF via webhook URL parameter
3. [HIGH] Internal API has no auth (trusts network boundary)
4. [CRITICAL CHAIN] Learn internal URLs → SSRF to internal API → access database/admin functions
```

## Chain Patterns for Our Stack (Next.js + Supabase)

### Next.js Specific Chains
```
Missing auth on Server Action + IDOR on resource ID
→ Unauthenticated data modification of any user's resources

Verbose error in API route + SSRF via fetch proxy
→ Map internal infrastructure + access metadata

getSession() instead of getUser() + JWT tampering
→ Forge admin claims + access admin-only features

Image wildcard + redirect on allowed CDN
→ SSRF through image optimization → metadata theft
```

### Supabase Specific Chains
```
Missing RLS on table + anon key in frontend (always true)
→ Complete database dump with single curl command

service_role in NEXT_PUBLIC_ + any frontend access
→ Full database bypass, complete CRUD on all tables

Missing RLS on storage.objects + public bucket
→ Access all user files, upload malicious content

SECURITY DEFINER function + missing auth check inside
→ RLS bypass via RPC function call
```

### Cross-Stack Chains
```
XSS in React component + Supabase session token in cookie (not HttpOnly)
→ Session theft → full account access

Race condition on entry submission + missing unique constraint
→ Bypass entry limit → unfair advantage in competition

Open redirect + OAuth callback + Supabase Auth
→ Steal auth tokens during social login flow
```

## How to Present Chains in Reviews

### Chain Finding Format
```
## 🔗 Exploit Chain: [Name]

**Chain Severity**: CRITICAL
**Individual Findings**: F1 (Medium) + F2 (Low) + F3 (Medium)
**Chain Impact**: [Full description of what attacker achieves]

### Attack Path
1. **F1**: [Finding] — attacker gains [output]
2. **F2**: [Finding] — using [F1 output], attacker obtains [output]  
3. **F3**: [Finding] — using [F2 output], attacker achieves [final impact]

### Why These Chain
[Explain the logical connection between findings]

### Fix Priority
Fix **F1** first — it breaks the entire chain.
[Or: Fix F3 — it's the highest impact step and may be easiest to patch]
```

### Chain-Breaking Strategy
You don't have to fix every link. Breaking ONE link breaks the chain:
- **Break at the cheapest point**: Which fix requires least effort?
- **Break at the earliest point**: Stops the attacker soonest
- **Break at the highest-impact point**: Even if other links survive, the final step fails
- **Defense in depth**: Fix multiple links (preferred for critical chains)

## Training the Chain Mindset

After every code review, spend 5 minutes asking:

1. **"If I were attacking this app, where would I start?"** — What's the weakest entry point?
2. **"What does this finding give me?"** — Not just the direct impact, but what INFORMATION or ACCESS does it provide?
3. **"What could I do with that?"** — Which other weakness becomes exploitable with this new capability?
4. **"What's the worst case?"** — Follow the chain to its logical end

This is the mindset that separates a vulnerability lister from a threat modeler.

## Integration with Review Process

Add as **Phase 11: Chain Analysis** (after Phase 10: Adversarial Review):

1. List all findings from the review (including P3/Low severity)
2. For each finding, document what it PROVIDES to an attacker
3. Draw connections between findings
4. Walk any chains from external attacker to critical impact
5. If chains exist, escalate the chain severity to the verdict
6. Recommend chain-breaking fixes in priority order

## References

For individual vulnerability detection, see all other security skills.
For detailed chain examples by category, see `references/chain-examples.md`.