Bug Chaining & Escalation

Individual low/medium bugs often chain together into critical impact. Always ask: can this go further?

• Low bugs alone may be informational – find the chain that makes them critical
• Self-XSS becomes high if you can deliver it via CSRF
• Open redirect becomes critical if chained with OAuth
• CORS misconfiguration + sensitive API endpoint = high/critical
• IDOR on non-sensitive data + mass enumeration = data breach = high

Always frame bugs in terms of what an attacker can actually do:

• “Attacker can read all users' private messages” (data breach)
• “Attacker can take over any account without interaction” (ATO)
• “Attacker can access the admin panel and modify all user data” (full compromise)

Generic impact (“this could be used for phishing”) is weak. Show the chain.

• After a bug is fixed, test the exact fix
• Devs usually only fix the specific reported endpoint
• Check if the root cause is patched everywhere in the app
• The same code pattern is often reused – look for it elsewhere

• XSS Testing
• CSRF Testing
• Open Redirects
• SSRF Testing
• Writing Good Reports
• Methodology Index