<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-vulnerability-chaining
description: >-
  Identify and exploit vulnerability chains where multiple low or medium
  severity findings combine to achieve critical impact through sequential
  exploitation across system boundaries.
domain: cybersecurity
subdomain: security-testing
tags:
  - vulnerability-chaining
  - exploit-chain
  - attack-path
  - privilege-escalation
  - lateral-movement
  - impact-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1068", "T1078", "T1021", "T1548"]
  tools: ["python3", "burp-suite", "metasploit", "bloodhound", "impacket"]
---

# Implementing Vulnerability Chaining

## Overview

Vulnerability chaining demonstrates how individually low-risk findings can
combine into critical attack paths. A misconfiguration alone may be medium
severity, but combined with an SSRF and a privilege escalation, it becomes
a full compromise. This technique maps and validates multi-step chains.

## Prerequisites

| Requirement | Details |
|---|---|
| Individual vulnerability findings from prior testing | Required |
| Network and application architecture understanding | Required |
| Multiple testing tools for cross-boundary exploitation | Required |
| Authorization for extended exploitation testing | Required |

## Key Concepts

- **Chain links**: Individual vulnerabilities forming a sequence
- **Pivot points**: Where one exploit enables access to the next target
- **Impact amplification**: Combined severity exceeds individual findings
- **Kill chain mapping**: Map chain to MITRE ATT&CK phases
- **Dependency analysis**: Identify which links are required vs. optional

## Workflow

### Step 1: Map Available Vulnerabilities

```python
from dataclasses import dataclass

@dataclass
class VulnerabilityLink:
    """Single vulnerability in a potential chain."""
    vuln_id: str
    severity: str
    target: str
    vuln_type: str
    provides: list[str]  # What this exploit gives us
    requires: list[str]  # What we need before exploiting

FINDINGS = [
    VulnerabilityLink("V001", "medium", "web_app", "SSRF",
                      provides=["internal_network_access"],
                      requires=["web_access"]),
    VulnerabilityLink("V002", "low", "metadata_service", "info_disclosure",
                      provides=["aws_credentials"],
                      requires=["internal_network_access"]),
    VulnerabilityLink("V003", "medium", "aws_iam", "privilege_escalation",
                      provides=["admin_access"],
                      requires=["aws_credentials"]),
]
```

### Step 2: Build Attack Graphs

```python
def find_chains(
    findings: list[dict],
    initial_access: list[str],
    target_impact: str,
) -> list[list[dict]]:
    """Find exploitation chains from initial access to target impact."""
    chains = []
    available = set(initial_access)

    def _dfs(current_chain: list[dict], available_caps: set[str]) -> None:
        for f in findings:
            if f["vuln_id"] in [c["vuln_id"] for c in current_chain]:
                continue
            if all(r in available_caps for r in f["requires"]):
                new_chain = current_chain + [f]
                new_caps = available_caps | set(f["provides"])
                if target_impact in new_caps:
                    chains.append(new_chain)
                _dfs(new_chain, new_caps)

    _dfs([], available)
    return chains
```

### Step 3: Validate Exploitation Chain

```bash
# Validate each link in sequence
node agent.js map --findings findings.json --target admin_access
node agent.js validate --chain chain_001.json --execute
node agent.js report --chain chain_001.json --format finding
```

### Step 4: Calculate Combined Impact

```python
def calculate_chain_severity(chain: list[dict]) -> dict:
    """Calculate combined severity of vulnerability chain."""
    individual_max = max(
        {"critical": 4, "high": 3, "medium": 2, "low": 1}.get(v["severity"], 0)
        for v in chain
    )
    chain_impact = min(4, individual_max + len(chain) - 1)
    severity_map = {4: "critical", 3: "high", 2: "medium", 1: "low"}
    return {
        "chain_length": len(chain),
        "individual_max_severity": severity_map.get(individual_max, "info"),
        "combined_severity": severity_map.get(chain_impact, "info"),
        "impact_amplification": chain_impact > individual_max,
    }
```

## Detection

```yaml
title: Vulnerability Chaining Detection
id: d6ae6a2a-4010-4c64-b64b-94883f68794c
status: experimental
description: Detects suspicious activity related to implementing vulnerability chaining techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*vulnerability*"
  condition: selection
level: medium
tags:
  - attack.t1068
  - attack.t1078
  - attack.t1021
  - attack.t1548
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Vulnerability Chaining Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1068, T1078, T1021, T1548 |

## Verification

- [ ] All individual vulnerabilities confirmed exploitable
- [ ] Chain executed end-to-end in sequence
- [ ] Each pivot point documented with evidence
- [ ] Combined impact accurately assessed
- [ ] Remediation addresses weakest link

## References

- [MITRE ATT&CK — Attack Chains](https://attack.mitre.org/)
- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [BloodHound — Attack Path Mapping](https://bloodhound.readthedocs.io/)
