exploit-chain-building

What this skill does

Guides a security researcher from a confirmed low or medium severity finding through a structured escalation process to discover multi-step exploit chains that demonstrate significantly higher impact. Uses a chain table of known A→B→C escalation paths, tests each link in the chain for exploitability, and produces a combined CVSS score and step-by-step proof-of-concept that reflects the full chain impact rather than individual finding severity.

When to use

• When a confirmed finding is rated Low or Medium but feels like it could enable more
• When a bug bounty report needs to demonstrate maximum impact to justify a higher payout
• During a penetration test to escalate a foothold into a more significant compromise
• When triage shows multiple low-severity findings that may combine into a critical chain
• Before finalizing a report — to check whether any finding enables a higher-impact chain

Prerequisites

• At least one confirmed, reproducible finding as a starting point
• curl installed for HTTP-based chain verification
• Burp Suite or equivalent HTTP proxy (recommended for interactive chain testing)
• Access to the target application with a test account
• Written authorization for all testing activities