Chaining Vulnerabilities and Post-Exploitation
What this domain tests
Chaining Vulnerabilities and Post-Exploitation tests whether you can combine low-impact findings into a credible compromise and then operate safely. The exam rewards a clear chain, evidence, and controlled post-exploitation, not a pile of unrelated bugs.
Core rules and concepts
- Chain by trust boundary: recon finds a hidden route, auth bypass reaches it, injection executes, access control exposes data.
- Prefer the shortest reliable chain. A working LFI-to-log-poisoning path beats an unreliable deserialization gadget.
- Post-exploitation begins with situational awareness:
id,hostname,env, network interfaces, mounted secrets, and application config. - Harvest credentials from environment variables, config files, database dumps, and CI tokens; reuse them only within scope.
- Maintain a timeline: request, payload, response, timestamp, and impact. Clean up test artifacts and avoid destructive actions.
- Document prerequisites for each link so the chain is reproducible without guesswork.
Worked example
Recon finds /download?file=report.pdf. You test file=../../../../var/log/apache2/access.log, then send a request with User-Agent: <?php system($_GET['c']); ?>. Including the log executes the payload, giving c=id. The reasoning is that LFI reads arbitrary files, the log is writable by the web server, and PHP execution turns file read into RCE. From the shell you read .env, find database credentials, and pivot to the internal admin panel.
Traps that cost marks
- Stopping at the first RCE and not documenting the prerequisite findings.
- Using noisy reverse shells when a simple command output proves impact.
- Reusing credentials outside the authorized scope.
- Leaving uploaded webshells or modified records behind.