Chain: SSRF to RCE
Canonical path
- SSRF reaches metadata/internal control plane.
- Extract credential/token or access internal admin API.
- Use credential to deploy or execute payload.
- Confirm code execution and business impact.
Graph guidance
- Add
enablesedges for each pivot. - Lower weights for direct pivots; higher for speculative pivots.
- Run
plan_attack_chainsand thensuggest_objectives_from_chains.