exploit-chain-building

What this skill does

Guides a security researcher from a confirmed low or medium severity finding through a structured escalation process to discover multi-step exploit chains that demonstrate significantly higher impact. Uses a chain table of known A→B→C escalation paths, tests each link in the chain for exploitability, and produces a combined CVSS score and step-by-step proof-of-concept that reflects the full chain impact rather than individual finding severity.

When to use

• When a confirmed finding is rated Low or Medium but feels like it could enable more
• When a bug bounty report needs to demonstrate maximum impact to justify a higher payout
• During a penetration test to escalate a foothold into a more significant compromise
• When triage shows multiple low-severity findings that may combine into a critical chain
• Before finalizing a report — to check whether any finding enables a higher-impact chain

Prerequisites

• At least one confirmed, reproducible finding as a starting point
• curl installed for HTTP-based chain verification
• Burp Suite or equivalent HTTP proxy (recommended for interactive chain testing)
• Access to the target application with a test account
• Written authorization for all testing activities

Inputs

Variable	Required	Description
SECSKILL_INITIAL_FINDING	required	Description of the confirmed starting vulnerability (e.g. Self-XSS in profile bio field)
SECSKILL_TARGET_URL	required	Base URL of the target application
SECSKILL_AUTH_TOKEN	optional	Session cookie or Bearer token for the test account
SECSKILL_OUTPUT_DIR	optional	Directory to save chain evidence (default: ./output)

Workflow

Step 1: Confirm the initial finding

Before attempting escalation, verify the starting vulnerability is reliably reproducible. Document the exact steps, request, and response.

export TARGET="${SECSKILL_TARGET_URL:?Set SECSKILL_TARGET_URL}"
export FINDING="${SECSKILL_INITIAL_FINDING:?Set SECSKILL_INITIAL_FINDING}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export AUTH="${SECSKILL_AUTH_TOKEN:-}"
mkdir -p "$OUTDIR"

echo "[*] Starting finding: $FINDING"
echo "[*] Target: $TARGET"
echo "[*] Reproduce the finding and save evidence to: $OUTDIR/step1_initial_finding.txt"