PT2 · Module 5
Chaining Vulnerabilities
Combine low-severity findings into critical compromise through methodology, business-logic abuse, and source-code review to spot gadget chains.
~8 h 3 resources Last updated October 4, 2026
A low-severity finding on its own becomes critical when combined with two others. PT2 explicitly tests chaining: candidates who stop at the first exploitable primitive miss the finding the exam is looking for. This module covers the methodology for spotting chains, the business-logic flaws that often serve as the pivot point, and the source-code review approach that reveals which chains the application actually enables.
Methodology
Assessment is iterative. Enumerate, find a primitive, ask what it unlocks, use the new access to enumerate further, repeat. Classic chains documented on the web-assessment page: traversal to DB credentials to database access; SQLi to file write to RCE; SSRF to cloud metadata to account takeover; stored XSS in an admin-visible field to session theft to admin control; IDOR on a role-assignment endpoint to privilege escalation.
Business Logic
Framework scanners miss logic flaws because they are application-specific. Price manipulation on checkout, multi-step bypass by skipping to the final request, client-side control reliance, insufficient server-side validation, and race conditions on uniqueness-dependent operations (coupon redemption, invite acceptance, balance withdrawal) all surface here.
Source Code Review
Where source is available, sink-first and entry-point-driven reviews surface chains automation misses. Dangerous sinks per language (eval, exec, include, unserialize, raw SQL concatenation) mark the destinations; tracing user input to those sinks reveals the chain. Semgrep rules and grep patterns accelerate the sweep.
Writing Up Chains
The chain is the finding. Each primitive stays documented separately in the report with its own severity, but the chain gets its own section describing the end-to-end impact: the step-by-step path, the final business impact, and the fix that would break any one link.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 6 min readWeb Assessment Methodology
-
Guide 6 min readSource Code Review for Web VulnerabilitiesFocus on #Bottom-Up: Sink-First Review #Top-Down: Entry-Point-Driven Review #Dangerous Sinks by Language #PHP #Python #Java #.NET (C#) #JavaScript / Node.js #Grep Patterns for Rapid Discovery #Using Semgrep #Database Query Logging #MySQL #PostgreSQL #Tracing User Input to Sink #Building Exploit Chains
Practice
Apply the module hands-on.
- Chaining Vulnerabilities TryHackMe Easy
- Extract TryHackMe Hard
- Voyage TryHackMe Medium
- Sequence TryHackMe Medium
- TwoMillion HackTheBox Easy
- Pilgrimage HackTheBox Easy
- Jupiter HackTheBox Medium
- Exfiltrated Proving Grounds Easy