# Chaining Vulnerabilities

> Combine low-severity findings into critical compromise through methodology, business-logic abuse, and source-code review to spot gadget chains.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities
- **Certification:** [PT2 (Penetration Tester Level 2) Study Path](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path.md)
- **Estimated study hours:** 8
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

A low-severity finding on its own becomes critical when combined with two others. PT2 explicitly tests chaining: candidates who stop at the first exploitable primitive miss the finding the exam is looking for. This module covers the methodology for spotting chains, the business-logic flaws that often serve as the pivot point, and the source-code review approach that reveals which chains the application actually enables.

## Methodology

Assessment is iterative. Enumerate, find a primitive, ask what it unlocks, use the new access to enumerate further, repeat. Classic chains documented on the web-assessment page: traversal to DB credentials to database access; SQLi to file write to RCE; SSRF to cloud metadata to account takeover; stored XSS in an admin-visible field to session theft to admin control; IDOR on a role-assignment endpoint to privilege escalation.

## Business Logic

Framework scanners miss logic flaws because they are application-specific. Price manipulation on checkout, multi-step bypass by skipping to the final request, client-side control reliance, insufficient server-side validation, and race conditions on uniqueness-dependent operations (coupon redemption, invite acceptance, balance withdrawal) all surface here.

## Source Code Review

Where source is available, sink-first and entry-point-driven reviews surface chains automation misses. Dangerous sinks per language (`eval`, `exec`, `include`, `unserialize`, raw SQL concatenation) mark the destinations; tracing user input to those sinks reveals the chain. Semgrep rules and grep patterns accelerate the sweep.

## Writing Up Chains

The chain is the finding. Each primitive stays documented separately in the report with its own severity, but the chain gets its own section describing the end-to-end impact: the step-by-step path, the final business impact, and the fix that would break any one link.

## Study material

- [Web Assessment Methodology](https://hackindex.io/services/web/exploitation/web-assessment-methodology.md) (read, core)
- [Business Logic Exploitation](https://hackindex.io/services/web/exploitation/business-logic-exploitation.md) (read, core)
- [Source Code Review for Web Vulnerabilities](https://hackindex.io/services/web/exploitation/source-code-review-methodology.md) (read, core)