Vulnerability Chaining (the team lead)

Overview

Individual findings undersell real risk. Attackers don't stop at one bug — they chain them: an info leak feeds an enumeration, which feeds an auth bypass, which reaches admin. This skill takes the register from all FIND/EXPLOIT specialists and assembles attack paths.

Core principle: Chain impact is multiplicative, not additive. Three "Mediums" that connect can equal one "Critical." Severity belongs to the path, not the isolated bug.

⚠️ Authorization

Demonstrate chains only on your own/authorized non-prod instance. Prove the path with the minimum steps; stop at proof of impact — no persistence, no real-data exfiltration, no pivoting to systems out of scope.