Chaining Exploits into Full Compromise and Post-Exploitation Pivoting
Chaining Exploits into Full Compromise and Post-Exploitation Pivoting tests whether you can combine low-severity findings into a credible path to sensitive access. CWEE values a documented chain with clear prerequisites over isolated payloads.
Build the chain
Start with an entry primitive: information disclosure, IDOR, SSRF, or upload. Use it to obtain credentials, tokens, or internal reachability. Then escalate: reuse credentials against admin panels, pivot through SSRF to internal APIs, or turn file write into execution. After access, enumerate the host and adjacent services, identify privilege boundaries, and collect only the evidence needed to prove impact. Maintain a timeline of requests and state changes so the chain is reproducible.
Worked example
A JavaScript bundle leaks an internal API host. SSRF reaches that host and returns a service token. The token authorizes an admin export endpoint, which returns password hashes. Cracking one hash gives SSH access to an application server, where a cloud metadata credential permits limited object-storage reads. Each step is documented with the request, response, and resulting capability.
Traps
Stopping at the first bug often misses the actual objective. Noisy scanning can invalidate a chain or trigger lockouts. Using another user's real data instead of a controlled test account is poor practice. Failing to record prerequisites makes the chain look unreproducible. Pivoting without checking scope can cross authorization boundaries.