Exploit Chains

Multi-step attack flows that single-request scanners miss. Sectora's Chain Engine links findings into the kill-chain attackers actually walk: discovery → enumeration → privilege escalation → data exfil.

Why single-request scanning misses real attacks

A typical scanner tests endpoint A in isolation. It might not look exploitable on its own (e.g. an IDOR that requires knowing valid user IDs). But chain it with endpoint B (which leaks user IDs), and the chain is critical. Real attackers chain; single-request scanners don't.

What Chain Engine looks for

Common chains the engine surfaces:

  • ID enumeration → IDOR — a list endpoint leaks IDs; a detail endpoint accepts arbitrary IDs.
  • Info disclosure → privilege escalation — error message leaks tokens or internal paths; those paths grant admin access.
  • Open registration → CSRF → account takeover — anyone can register; weak CSRF protection on session change.
  • SSRF → metadata service → cloud credential theft — fetch endpoint allows internal URLs; AWS/GCP metadata service is reachable from the SSRF.
  • Stored XSS → cookie theft → session hijack — comment field stores XSS; cookies aren't HttpOnly.
  • File upload → MIME confusion → RCE — accepts arbitrary file types; serves them with their declared MIME; HTML uploads execute as HTML.

How chains are constructed

  1. The DAST engine runs as normal, producing individual findings.
  2. The Chain Engine evaluates each finding pair (and triples) against a taxonomy of known chain patterns.
  3. For each candidate chain, the engine attempts to execute it — verifies that the chain ACTUALLY works against the live target.
  4. Verified chains appear as a single "Exploit Chain" finding linking the constituent findings.
  5. Severity is the chain's severity, NOT the max of its components — a chain of three Medium findings can be Critical because the chain enables full takeover.

Exploit Chain finding details

Each chain finding includes:

  • The full sequence of requests, in order, with response context
  • What each step achieves ("step 1 enumerates user IDs", "step 2 uses an ID to fetch admin data")
  • Total chain impact (data accessed / privileges gained)
  • Recommended remediation — usually fixing ONE of the chain steps breaks the whole chain. The engine identifies the cheapest fix.

Visualization

The Exploit Chains dashboard renders chains as flow diagrams — nodes are findings, edges are the exploitation step that links them. Useful for explaining risk to executives who don't care about individual CVE IDs.

Performance impact

What's next

  • DAST — produces the individual findings the chain engine combines.
  • Virtual Patching — break a chain by patching its cheapest step.