How do I install the Exploit Chaining skill?

Run npx skillmds@latest add noorqureshi/exploit-chaining in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Exploit Chaining safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Exploit Chaining?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Exploit Chaining free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Exploit Chaining?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Exploit Chaining by noorqureshi — Agent Skill

Name: Exploit Chaining
Author: NoorQureshi

Exploit Chaining

Combine low/medium findings into one high-impact exploit chain, and amplify demonstrated impact. Load when you have several small bugs, a "so what?" finding, on "chain", "escalate impact", or building the narrative for a report. Signals: self-XSS + CSRF, open-redirect + OAuth, IDOR + info-leak, SSRF + metadata.

NoorQureshi 3d6a465 2.2 KB Updated Sep 17, 2026

File contents

Exploit chaining & impact amplification

When it applies

You have bugs that are individually "meh" (self-XSS, an info leak, an open redirect, a weak CSRF) and need to turn them into something a program pays for — or a pentest foothold that needs several bugs stacked.

Why it works

Impact is compositional. One bug supplies a precondition another needs: a leak provides the id IDOR needs; an open redirect makes OAuth leak a token; SSRF reaches the metadata service that yields cloud creds. The chain's severity is the end impact, not the weakest link.

Method

Inventory every finding with what it gives and what it needs (primitive in / out).
Look for matches: does bug A's output satisfy bug B's precondition? Common chains:
- self-XSS + login-CSRF / cookie-fixation → land XSS in the victim's session.
- open redirect + OAuth redirect_uri → steal the authorization code → ATO.
- IDOR/info-leak → user id/UUID → BOLA on another endpoint.
- SSRF → cloud-imds-ssrf → IAM creds → cloud impact.
- file upload (stored) → XSS/SSRF/RCE depending on how it's served.
Build the shortest reliable path to the highest impact; script the PoC end-to-end.
Write the narrative: state the end impact first, then each link with its role, so a triager sees severity immediately (see reporting-bug-bounty-writeup).

Gotchas

Don't over-chain — the simplest path to real impact is more credible and reproducible.
Each link must be reliable; a flaky step sinks the whole chain in triage.
Keep every step in scope and within RoE — a chain that steps out of scope is unreportable.

Verify success

A single reproducible PoC that starts from attacker-controlled input and ends at concrete high impact (ATO, data access, RCE, cloud takeover).

References

Bug-bounty disclosed chains (HackerOne Hacktivity); PortSwigger chained-attack labs.

---name: exploit-chainingdescription: Combine low/medium findings into one high-impact exploit chain, and amplify demonstrated impact. Load when you have several small bugs, a "so what?" finding, on "chain", "escalate impact", or building the narrative for a report. Signals: self-XSS + CSRF, open-redirect + OAuth, IDOR + info-leak, SSRF + metadata.---# Exploit chaining & impact amplification## When it appliesYou have bugs that are individually "meh" (self-XSS, an info leak, an open redirect, a weakCSRF) and need to turn them into something a program pays for — or a pentest foothold that needsseveral bugs stacked.## Why it worksImpact is compositional. One bug supplies a precondition another needs: a leak provides the idIDOR needs; an open redirect makes OAuth leak a token; SSRF reaches the metadata service thatyields cloud creds. The chain's severity is the *end* impact, not the weakest link.## Method1. **Inventory every finding** with what it gives and what it needs (primitive in / out).2. **Look for matches**: does bug A's output satisfy bug B's precondition? Common chains: - self-XSS + login-CSRF / cookie-fixation → land XSS in the victim's session. - open redirect + OAuth `redirect_uri` → steal the authorization code → ATO. - IDOR/info-leak → user id/UUID → BOLA on another endpoint. - SSRF → `cloud-imds-ssrf` → IAM creds → cloud impact. - file upload (stored) → XSS/SSRF/RCE depending on how it's served.3. **Build the shortest reliable path** to the highest impact; script the PoC end-to-end.4. **Write the narrative**: state the end impact first, then each link with its role, so a triager sees severity immediately (see `reporting-bug-bounty-writeup`).## Gotchas- Don't over-chain — the simplest path to real impact is more credible and reproducible.- Each link must be reliable; a flaky step sinks the whole chain in triage.- Keep every step in scope and within RoE — a chain that steps out of scope is unreportable.## Verify successA single reproducible PoC that starts from attacker-controlled input and ends at concretehigh impact (ATO, data access, RCE, cloud takeover).## ReferencesBug-bounty disclosed chains (HackerOne Hacktivity); PortSwigger chained-attack labs.

Frequently asked questions