skills.rest
dbx0
dbx0COMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploit-chaining-engine

Scores and composes weak security findings into prioritized exploit chains.

7|4|Updated Jun 22, 2026
Search Tags:#penetration testing#privilege escalation#security assessment#bug bounty#exploit chaining#attack path#vulnerability scoring
One-click install
npx skills add https://github.com/dbx0/skills --skill exploit-chaining-engine-dbx0
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploit-chaining-engine
Source: https://github.com/dbx0/skills/tree/main/skills/methodology/exploit-chaining/exploit-chaining-engine
Command: npx skills add https://github.com/dbx0/skills --skill exploit-chaining-engine-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security assessments often produce isolated low or medium findings that get undervalued because their combined impact is never analyzed. This Skill provides a structured methodology to score each finding's chainability and compose primitives into high-impact exploit paths such as account takeover, privilege escalation, or cross-tenant data access. ## Core Features & Use Cases - Dual Scoring Model: Assigns every finding a severity_score and a chainability_score (0-5 rubric) so composable mediums outrank isolated highs. - Primitive-to-Impact Ladders: Provides concrete pivot playbooks for ID/GID disclosure, invite/reset abuse, export and attachment leakage, import/parser confusion, rendering/cache sinks, and billing race conditions. - Chain-Building Workflow: Forces each primitive through a five-step sequence (primitive, trust boundary, carrier object, authority upgrade, minimal proof) to demonstrate real business impact with synthetic data. - Use Case: During a web app assessment you find a secondary-object IDOR and a stale invite token. Use this Skill to chain them into a proven account takeover path and record it with the exploit chain card template. ## Quick Start Analyze my current findings and build the highest-impact exploit chain from the available primitives.

Frequently Asked Questions about exploit-chaining-engine

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I chain low severity vulnerabilities into a critical exploit?▼

Score each finding with a chainability rubric from 0 to 5, then push every primitive through five steps: name the primitive, identify the trust boundary, find the carrier object, determine the authority upgrade, and prove the minimal high-impact path. A medium finding with chainability 4 or 5 often outranks an isolated high.

What is a chainability score in vulnerability assessment?▼

A chainability score rates how far a finding can pivot toward real impact, from 0 (isolated informational signal) to 5 (directly composes into account takeover, privilege escalation, cross-tenant access, RCE, or financial loss). It prioritizes findings by reachable authority rather than endpoint severity.

Which vulnerability types are best for exploit chaining?▼

High-chainability primitives include leaked tokens or secrets, reset and invite abuse, secondary-object IDOR, export or attachment leakage, GraphQL helper mutation drift, import parser confusion, role drift, admin plane exposure, and full-response SSRF. These reach sessions, roles, secrets, or internal services within one or two pivots.

When should I prefer a medium finding over a high severity one?▼

Prefer the medium finding when its chainability score is higher, meaning it reaches sessions, roles, exports, secrets, internal services, or financial state. Score primitives by the strongest authority they can reach after one or two realistic pivots, not by the endpoint where they were found.

How do I prove exploit chain impact without harming production?▼

Demonstrate one clean account takeover, privilege change, cross-tenant disclosure, or financial loss using synthetic data and minimal collateral. The methodology's decision rule explicitly prefers paths provable with clean synthetic data over noisy or destructive testing.

Related Skills

Explore More Software Engineering Skills→
xijunwwxijunww
1

recon

Automate penetration testing reconnaissance to discover assets and attack surfaces.

Community
Advanced
baiqigobaiqigo
10

triage-validation

Validates security findings through a 7-question gate before report submission.

Community
Intermediate
marcboggsmarcboggs

chain

Builds multi-step exploit chains by combining confirmed bug bounty findings into higher-severity attack paths.

Community
Intermediate
blamejsblamejs

exploit-scoring

Calculate RWEP priority scores for CVEs using exploit availability and threat patterns.

Official
Advanced