# Exploit Chaining

> Combine low/medium findings into one high-impact exploit chain, and amplify demonstrated impact. Load when you have several small bugs, a "so what?" finding, on "chain", "escalate impact", or building the narrative for a report. Signals: self-XSS + CSRF, open-redirect + OAuth, IDOR + info-leak, SSRF + metadata.

- Skill: `noorqureshi/exploit-chaining` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/exploit-chaining`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/exploit-chaining/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/exploit-chaining

---


# Exploit chaining & impact amplification

## When it applies
You have bugs that are individually "meh" (self-XSS, an info leak, an open redirect, a weak
CSRF) and need to turn them into something a program pays for — or a pentest foothold that needs
several bugs stacked.

## Why it works
Impact is compositional. One bug supplies a precondition another needs: a leak provides the id
IDOR needs; an open redirect makes OAuth leak a token; SSRF reaches the metadata service that
yields cloud creds. The chain's severity is the *end* impact, not the weakest link.

## Method
1. **Inventory every finding** with what it gives and what it needs (primitive in / out).
2. **Look for matches**: does bug A's output satisfy bug B's precondition? Common chains:
   - self-XSS + login-CSRF / cookie-fixation → land XSS in the victim's session.
   - open redirect + OAuth `redirect_uri` → steal the authorization code → ATO.
   - IDOR/info-leak → user id/UUID → BOLA on another endpoint.
   - SSRF → `cloud-imds-ssrf` → IAM creds → cloud impact.
   - file upload (stored) → XSS/SSRF/RCE depending on how it's served.
3. **Build the shortest reliable path** to the highest impact; script the PoC end-to-end.
4. **Write the narrative**: state the end impact first, then each link with its role, so a
   triager sees severity immediately (see `reporting-bug-bounty-writeup`).

## Gotchas
- Don't over-chain — the simplest path to real impact is more credible and reproducible.
- Each link must be reliable; a flaky step sinks the whole chain in triage.
- Keep every step in scope and within RoE — a chain that steps out of scope is unreportable.

## Verify success
A single reproducible PoC that starts from attacker-controlled input and ends at concrete
high impact (ATO, data access, RCE, cloud takeover).

## References
Bug-bounty disclosed chains (HackerOne Hacktivity); PortSwigger chained-attack labs.