Vulnerability Chaining, Correlation & Novel-Bug Hunting

The skill that turns a list of findings into an attack. Real-world compromise is rarely one critical bug — it's a chain of small ones, and the real risk is the path, not the individual issue. This skill teaches how to combine, correlate, and discover.

0. Authorization gate

• Chaining/exploitation across the in-scope assets is authorized.
• Cross-domain movement (e.g., web → cloud → identity) is within the agreed scope before you traverse it.

1. Think in primitives, not "vulns"

Reframe each finding as a capability primitive — what it grants an attacker:

A chain is a sequence of primitives where each unlocks the inputs for the next.

2. Chaining methodology

1. Inventory primitives from all skills' findings (web, api, cloud, AD, network...).
2. Define goals (crown-jewel data, DA, cloud org-admin).
3. Backward-chain from each goal: what capability would achieve it? What primitive yields that capability? Repeat until you reach a primitive you already hold or can obtain.
4. Forward-chain from your current access to see what it unlocks.
5. Bridge domains — the highest-impact chains cross boundaries:
   • Web SSRF → cloud metadata creds → cloud IAM privesc → data.
   • Phish → workstation foothold → local privesc → AD cred access → DA.
   • Leaked repo secret → API key → over-permissive cloud role → lateral.
   • On-prem AD compromise → hybrid sync → Entra global admin (and reverse).
6. Validate each link actually works end to end (a chain is only as strong as its weakest assumption).

3. Correlation

• Same root cause, many symptoms: cluster findings that share a cause (e.g., one missing authorization layer causing IDOR across many endpoints) → fix the cause once.
• Compounding: individually-low findings that together cross a severity threshold (rate-limit gap + weak password policy + no MFA = practical account takeover).
• Cross-tool correlation: merge outputs from the domain skills into one graph; a finding trivial in isolation may be the missing edge in a critical path.
• Temporal/behavioral: correlate what defenders can/can't see per step (feeds the purple-team detection-gap matrix in red-team-ops).

4. Attack-path graphing

Model the environment as a graph: nodes = assets/identities/data; edges = primitives/relationships that let you move between them. Then:

• Find shortest paths from an entry point to each goal.
• Identify choke-point edges: the single edge appearing in the most paths to crown jewels — fixing it breaks many chains at once (maximum-leverage remediation).
• BloodHound does this for AD; apply the same reasoning manually across web/api/cloud/identity.

5. Hunting novel & logic vulnerabilities (what scanners miss)

Scanners find known patterns; novel bugs live in your system's unique logic and assumptions.

• Model intended behavior, then break the assumption: every "the client will always…" or "this can only be reached after…" is a hypothesis to test.
• Business-logic classes: state-machine skips, race conditions/TOCTOU, quantity/price/limit manipulation, replay, workflow reordering, trust of client-controlled data, inconsistent authorization between endpoints doing the "same" thing.
• Boundary & type confusion: how components disagree about parsing/encoding/identity (parser differentials, unicode/normalization, request smuggling between proxy and app).
• Emergent/integration bugs: vulnerabilities that exist only in how two secure-looking components interact (e.g., trust of an internal header, SSO assertion reuse).
• Hypothesis-driven PoC loop: form a hypothesis → craft a minimal test → observe → refine → confirm with a reproducible PoC. Document the reasoning, not just the payload.
• Variant analysis: once you find one novel bug, systematically look for the same mistake elsewhere in the codebase/app — root-cause patterns repeat.

6. Prioritization output

Deliver a ranked list where severity reflects chain impact, not just individual CVSS, plus the choke-point fixes that break the most paths. This is what makes remediation efficient and the report credible.

7. Reporting

Present: primitive inventory, the attack-path graph, each realized chain (with the goal reached), correlated root causes, and choke-point remediations. Feed into red-team-ops reporting. See references/chaining-playbook.md.

<sub>© 2026 noahfranklin · Part of the Gideon security suite · MIT License · Original work.</sub>