vulnerability-chaining
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseVulnerability Chaining (the team lead)
漏洞链（团队负责人）
Overview
概述
Individual findings undersell real risk. Attackers don't stop at one bug — they chain them:
an info leak feeds an enumeration, which feeds an auth bypass, which reaches admin. This skill
takes the register from all FIND/EXPLOIT specialists and assembles attack paths.
Core principle: Chain impact is multiplicative, not additive. Three "Mediums" that connect
can equal one "Critical." Severity belongs to the path, not the isolated bug.
单个发现低估了真实风险。攻击者不会止步于一个漏洞——他们会链接它们：
信息泄露助长枚举，枚举助长认证绕过，进而到达管理员。此skill从所有FIND/EXPLOIT专家那里获取记录，并组装攻击路径。
核心原则： 链式影响是乘数效应，而非加数效应。三个相连的"中危"可能等于一个"严重"。严重性属于路径，而非孤立的漏洞。
⚠️ Authorization
⚠️ 授权
Demonstrate chains only on your own/authorized non-prod instance. Prove the path with the
minimum steps; stop at proof of impact — no persistence, no real-data exfiltration, no pivoting
to systems out of scope.
仅在自己的/授权的非生产实例上演示链。以最小步骤证明路径；在影响证明处停止——不持久化，不真实数据外泄，不转向范围外的系统。
Method
方法
- Inventory primitives — re-read every finding as a capability, not a label:
- Info (enumeration, verbose errors, leaked ids/secrets, source maps)
- Foothold (any auth bypass, XSS, SSRF, upload)
- Escalation (IDOR→admin, privesc, mass assignment)
- Pivot (SSRF→metadata, leaked key→cloud, token reuse)
- Find adjacencies — output of one bug = precondition of another? (leaked email → no-rate-limit login → ATO; reflected XSS → steals admin session → admin IDOR).
- Build the path — order primitives start→goal (unauth → user → admin → data/RCE).
- Demonstrate safely — walk the chain end-to-end on staging, capturing each hop's PoC.
- Score the chain — rate by the final impact, then list the constituent bugs.
See for canonical chain templates.
references/attack-paths.md- 盘点原语 — 将每个发现重新解读为一种能力，而非一个标签：
- 信息（枚举、详细错误、泄露的ID/密钥、源代码映射）
- 立足点（任何认证绕过、XSS、SSRF、上传）
- 提权（IDOR→管理员、权限提升、批量赋值）
- 横向（SSRF→元数据、泄露密钥→云、令牌重用）
- 寻找相邻关系 — 一个漏洞的输出是否是另一个漏洞的前提？（泄露的邮箱→无速率限制登录→ATO；反射型XSS→窃取管理员会话→管理员IDOR）。
- 构建路径 — 按顺序排列原语，从起点到目标（未认证→用户→管理员→数据/RCE）。
- 安全演示 — 在暂存环境端到端走查链，捕获每一步的PoC。
- 链评分 — 按最终影响评级，然后列出组成漏洞。
参见 获取标准链模板。
references/attack-paths.mdQuick reference — high-value chains
快速参考 — 高价值链
| Chain | Path |
|---|---|
| Full account takeover | user enumeration → no rate limit → weak reset/JWT → ATO |
| XSS → admin compromise | stored XSS → steal admin cookie → admin BFLA → mass data |
| SSRF → cloud takeover | SSRF → |
| IDOR → privesc | IDOR leaks admin id/email → password reset on admin → admin access |
| Upload → RCE | unrestricted upload → web-accessible path → execute → shell |
| Logic → fraud | coupon race → negative balance → withdraw → financial loss |
| 链 | 路径 |
|---|---|
| 完全账户接管 | 用户枚举 → 无速率限制 → 弱重置/JWT → ATO |
| XSS → 管理员沦陷 | 存储型XSS → 窃取管理员cookie → 管理员BFLA → 海量数据 |
| SSRF → 云接管 | SSRF → |
| IDOR → 提权 | IDOR泄露管理员ID/邮箱 → 管理员密码重置 → 管理员访问 |
| 上传 → RCE | 无限制上传 → Web可访问路径 → 执行 → 获取shell |
| 逻辑 → 欺诈 | 优惠券竞态 → 负余额 → 提现 → 财务损失 |
Output
输出
One narrative per chain: the attack path (numbered hops), the constituent finding IDs, the
end impact in business terms, and the single point where breaking the chain stops it (the
cheapest fix). This is what makes leadership act.
每条链一个叙述：攻击路径（编号跳点）、组成发现ID、以业务语言描述的最终影响，以及打破链所需的关键单点（最便宜的修复）。这才是让领导层采取行动的关键。
Hand-off
交接
Findings come from all specialists; chains go to as your top criticals,
and to highlighting the cheapest chain-breaking fix.
pentest-reportingsecurity-hardening发现来自所有专家；链作为最重要的严重问题移交至 ，并将最便宜的断链修复方案移交至 。
pentest-reportingsecurity-hardeningCommon mistakes
常见错误
- Reporting bugs in isolation — you'll under-rate the real risk and the chain gets ignored.
- Building theoretical chains — each hop must be demonstrated, not assumed.
- Over-running the chain — stop at proven impact; don't persist or pivot out of scope.
- Missing the cheapest break — often one mid-chain fix kills several paths at once.
- 孤立报告漏洞——你会低估真实风险，导致链被忽略。
- 构建理论链——每一步必须演示，而非假设。
- 过度运行链——在已证明影响处停止；不要持久化或转向范围外。
- 错过最便宜的断点——通常链中一个修复就能同时阻断多条路径。