cross-attack-chains

Cross-Attack Chains

An attack chain is a sequence of verified security behaviors in which each step provides a prerequisite for the next. Several findings on the same target do not form a chain unless the dependency between them is demonstrated.

When to Use

• Two or more validated findings affect the same trust boundary.
• One finding exposes an identity, token, route, host, or capability needed by another.
• A report needs to distinguish standalone impact from compound impact.
• The next chain step cannot be tested safely and must be labeled inferred.

Prerequisites

• Captured evidence and negative controls for every component finding.
• Current authorization for the compound test and any increased side effects.
• Approved identities, synthetic records, callbacks, and cleanup procedure.
• A clear stop condition for sensitive data, availability, or scope changes.

How to Run

Create a chain record beneath the target output directory:

TARGET_ID="example-test"
OUTPUT_DIR="${OUTPUT_DIR:-./output}"
CHAIN_DIR="$OUTPUT_DIR/$TARGET_ID/chains"

mkdir -p "$CHAIN_DIR"
touch "$CHAIN_DIR/EXPLOIT_CHAINS.md"

Use evidence states consistently:

State	Meaning
Observed	Present in captured output
Confirmed	Security impact reproduced with a control
Inferred	Plausible dependency that has not been tested
Not tested	Excluded by scope, safety, or missing prerequisites

Procedure

1. Normalize Component Findings

For each component, record:

• expected and observed behavior;
• target, identity, and timestamp;
• positive evidence and negative control;
• side effects and cleanup;
• demonstrated impact;
• assumptions and testing limits.

Discard scanner labels and version-only leads that have not passed their owning skill's verification.

2. Draw the Dependency

Finding A
  output: approved user identifier
  enables: object lookup in Finding B

Finding B
  output: unauthorized synthetic object read
  enables: none