skills.rest
marcboggs
marcboggsCOMMUNITY
Explore all skills by this author →
GitHub

chain

Builds multi-step exploit chains by combining confirmed bug bounty findings into higher-severity attack paths.

1|Updated Aug 21, 2026
Search Tags:#oauth#xss#penetration testing#ssrf#bug bounty#idor#exploit chain
One-click install
npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill chain-marcboggs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: chain
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/bughunter/skills/pentest/chain
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill chain-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Bug bounty hunters often confirm a valid but low-severity finding (open redirect, DNS-only SSRF, missing rate limit) and leave payout on the table because they don't know which secondary bugs to look for. This Skill maps a confirmed finding to the most likely companion vulnerabilities and known high-value chain patterns. ## Core Features & Use Cases - A→B Signal Table: Given a confirmed bug class (IDOR, SSRF, XSS, SQLi, file upload, OAuth, GraphQL, race condition, S3 exposure, prompt injection), it lists the exact B and C candidates to test next. - Documented Chain Patterns: Includes six worked chains such as S3→JS bundle→OAuth secret, open redirect→OAuth code theft→ATO, XSS→CSRF→admin action, and SSRF→cloud metadata→IAM credentials. - Discipline Rules: Enforces Gate 0 validation for each link, requires separate reports per confirmed bug, and applies 20-minute time-boxing plus rabbit-hole stop signals. - Use Case: You confirmed an open redirect classified as Low. Invoke /chain, describe the finding, and get directed to test OAuth redirect_uri abuse for a full account-takeover chain. ## Quick Start Invoke /chain and describe your confirmed bug including its class, endpoint, current impact, and target platform to get candidate chain paths.

Frequently Asked Questions about chain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I chain bugs for higher bug bounty severity?▼

Start with a confirmed finding, then use the A→B signal table to identify which secondary bug classes commonly combine with it. For example, a confirmed open redirect should be tested against OAuth redirect_uri flows for authorization code theft leading to account takeover.

What bugs chain well with SSRF in bug bounty hunting?▼

SSRF with only DNS callback should be tested against internal IP ranges and cloud metadata endpoints like 169.254.169.254. Reaching cloud metadata can yield IAM credentials, escalating an Informational finding to Critical cloud account access.

Should chained vulnerabilities be reported together or separately?▼

Each independently confirmed bug gets its own report and payout unless they genuinely form a single attack chain. Every link must pass Gate 0 on its own: an attacker can perform it right now causing real harm.

When should I stop looking for chain candidates?▼

Stop if B is not confirmed within 20 minutes, if three consecutive candidates fail Gate 0, or if a candidate needs three or more simultaneous preconditions. Submit the confirmed findings and move on rather than chasing speculative links.

Can open redirect be escalated to account takeover?▼

Yes, when an OAuth flow accepts a redirect_uri that can route through the open redirect. The victim's authorization code is delivered to an attacker-controlled URL, which is then exchanged for a token, producing a Critical ATO chain.

Related Skills

Explore More Software Engineering Skills→
valITinovalITino
7

full-pentest

Automate authorized penetration testing workflows from recon to reporting.

Community
Advanced
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
HmbownHmbown

met-guard

Apply a directional guard to a single attack surface and document protected faces.

Community
Intermediate
uphiagouphiago
1.1k

hunt-misc

Identify miscellaneous vulnerabilities like access control failures and misconfigurations in SaaS platforms.

Community
Advanced