vuln-chain-composer

Name: vuln-chain-composer
Author: Orizon-eu

18stars4forks

How to install vuln-chain-composer?

orizon-eu/claude-code-pentest/vuln-chain-composer

$npx -y skills add Orizon-eu/claude-code-pentest --skill vuln-chain-composer

Installs into the current project.

Summary

Composes multi-step exploit chains by correlating vulnerabilities across domains, calculates real impact of chained findings, generates end-to-end PoC scripts, and produces bug bounty ready reports. Use when user asks to "chain vulnerabilities", "compose exploit chain", "correlat

Files · 1

View on GitHub

SKILL.md

1	# Vuln Chain Composer
2
3	The strategic brain. Correlates individual vulnerabilities into devastating multi-step exploit chains.
4
5	## Important
6
7	CRITICAL: This skill produces offensive security analysis. Only use with explicit authorization on the target systems.
8
9	## Instructions
10
11	### Step 1: Import Findings
12	Accept vulnerability data from:
13	1. JSON output from webapp-exploit-hunter, api-breaker, cloud-pivot-finder
14	2. Manual finding descriptions from the user
15	3. Attack tree data from attack-path-architect
16	4. Mixed sources - consolidate everything
17
18	```bash
19	python scripts/import_findings.py --input {findings_dir_or_files}
20	```
21
22	Normalize all findings to a common format:
23	- Vulnerability type (SQLi, XSS, SSRF, IDOR, etc.)
24	- Location (domain, URL, parameter)
25	- Severity (standalone)
26	- PoC (if available)
27	- Prerequisites (authentication level, specific conditions)
28
29	### Step 2: Cross-Domain Correlation
30
31	```bash
32	python scripts/correlate.py --findings {normalized_findings}
33	```
34
35	Analyze relationships between findings:
36
37	Same-Origin Chains:
38	- XSS on subdomain A + sensitive cookies scoped to parent domain = session hijack on all subdomains
39	- SSRF on subdomain B + internal API access = data exfiltration via internal endpoints
40	- Open redirect on auth endpoint + OAuth callback = token theft
41
42	Trust-Based Chains:
43	- Subdomain takeover + same cookie scope = full session hijack
44	- CI/CD access + deployment pipeline = production RCE
45	- Cloud metadata via SSRF + IAM overprivilege = full cloud compromise
46
47	Credential-Based Chains:
48	- SQL injection + password hashes = credential cracking + account takeover
49	- .env file exposure + database credentials = direct data access
50	- IDOR on user profile + email exposure = targeted phishing + account takeover
51
52	Escalation Chains:
53	- Low-privilege IDOR + mass assignment = privilege escalation to admin
54	- Self-XSS + CSRF = weaponized stored XSS affecting other users
55	- Rate limit bypass + brute-force + OTP bypass = authentication bypass
56
57	### Step 3: Chain Construction
58
59	```bash
60	python scripts/build_chains.py --correlations {correlation_data}
61	```
62
63	For each identified chain:
64
65	1. Define the chain narrative: Clear story from initial access to final impact
66	2. List each step with:
67	- Vulnerability exploited
68	- Specific URL/parameter
69	- What is gained at this step
70	- How it enables the next step
71	3. Map dependencies: What must succeed for the chain to work
72	4. Identify alternatives: If one step is fixed, is there a bypass?
73	5. Calculate chain feasibility: Product of individual step probabilities
74
75	### Step 4: Impact Recalculation
76
77	```bash
78	python scripts/calculate_impact.py --chains {chains_file}
79	```
80
81	Recalculate severity based on chain context:
82
83	Impact Amplifiers:
84	- Self-XSS (Low) + CSRF chain = Stored XSS affecting others (High)
85	- Info disclosure (Low) + credential reuse = Account takeover (Critical)
86	- SSRF (Medium) + cloud metadata = Full infrastructure access (Critical)
87	- IDOR (Medium) + PII access + mass enumeration = Data breach (Critical)
88
89	CVSS Recalculation:
90	For each chain, calculate:
91	- Attack Complexity: Based on number of steps and prerequisites
92	- Privileges Required: Based on initial access requirements
93	- User Interaction: Based on whether victim action is needed
94	- Scope: Changed if chain crosses trust boundaries
95	- Confidentiality/Integrity/Availability impact of the FINAL outcome
96
97	### Step 5: PoC Generation
98
99	```bash
100	python scripts/generate_chain_poc.py --chain {chain_file}
101	```
102
103	For each confirmed chain, generate:
104
105	1. Step-by-step reproduction guide with screenshots descriptions
106	2. Automated PoC script (Python) that:
107	- Executes each step in sequence
108	- Passes data between steps (tokens, cookies, IDs)
109	- Validates each step succeeded before continuing
110	- Generates evidence at each step
111	3. curl command sequence for manual reproduction
112	4. Video script: Narrated steps for recording a PoC video
113
114	### Step 6: Bug Bounty Report Generation
115
116	```bash
117	python scripts/generate_report.py --chains {chains_file} --format {platform}
118	```
119
120	Platform-optimized reports for:
121	- HackerOne format: Title, severity, description, steps to reproduce, impact, remediation
122	- Bugcrowd format: Similar with VRT classification
123	- Generic format: Professional pentest report style
124
125	Report structure per chain:
126	```
127	## Title
128	[Compelling, impact-focused title]
129
130	## Severity
131	[Recalculated sev

People who liked this also viewed

6 picks

Type

vuln-chain-composer

18stars4forks

View on GitHub

How to install vuln-chain-composer?

orizon-eu/claude-code-pentest/vuln-chain-composer

$npx -y skills add Orizon-eu/claude-code-pentest --skill vuln-chain-composer

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Vuln Chain Composer
2
3	The strategic brain. Correlates individual vulnerabilities into devastating multi-step exploit chains.
4
5	## Important
6
7	CRITICAL: This skill produces offensive security analysis. Only use with explicit authorization on the target systems.
8
9	## Instructions
10
11	### Step 1: Import Findings
12	Accept vulnerability data from:
13	1. JSON output from webapp-exploit-hunter, api-breaker, cloud-pivot-finder
14	2. Manual finding descriptions from the user
15	3. Attack tree data from attack-path-architect
16	4. Mixed sources - consolidate everything
17
18	```bash
19	python scripts/import_findings.py --input {findings_dir_or_files}
20	```
21
22	Normalize all findings to a common format:
23	- Vulnerability type (SQLi, XSS, SSRF, IDOR, etc.)
24	- Location (domain, URL, parameter)
25	- Severity (standalone)
26	- PoC (if available)
27	- Prerequisites (authentication level, specific conditions)
28
29	### Step 2: Cross-Domain Correlation
30
31	```bash
32	python scripts/correlate.py --findings {normalized_findings}
33	```
34
35	Analyze relationships between findings:
36
37	Same-Origin Chains:
38	- XSS on subdomain A + sensitive cookies scoped to parent domain = session hijack on all subdomains
39	- SSRF on subdomain B + internal API access = data exfiltration via internal endpoints
40	- Open redirect on auth endpoint + OAuth callback = token theft
41
42	Trust-Based Chains:
43	- Subdomain takeover + same cookie scope = full session hijack
44	- CI/CD access + deployment pipeline = production RCE
45	- Cloud metadata via SSRF + IAM overprivilege = full cloud compromise
46
47	Credential-Based Chains:
48	- SQL injection + password hashes = credential cracking + account takeover
49	- .env file exposure + database credentials = direct data access
50	- IDOR on user profile + email exposure = targeted phishing + account takeover
51
52	Escalation Chains:
53	- Low-privilege IDOR + mass assignment = privilege escalation to admin
54	- Self-XSS + CSRF = weaponized stored XSS affecting other users
55	- Rate limit bypass + brute-force + OTP bypass = authentication bypass
56
57	### Step 3: Chain Construction
58
59	```bash
60	python scripts/build_chains.py --correlations {correlation_data}
61	```
62
63	For each identified chain:
64
65	1. Define the chain narrative: Clear story from initial access to final impact
66	2. List each step with:
67	- Vulnerability exploited
68	- Specific URL/parameter
69	- What is gained at this step
70	- How it enables the next step
71	3. Map dependencies: What must succeed for the chain to work
72	4. Identify alternatives: If one step is fixed, is there a bypass?
73	5. Calculate chain feasibility: Product of individual step probabilities
74
75	### Step 4: Impact Recalculation
76
77	```bash
78	python scripts/calculate_impact.py --chains {chains_file}
79	```
80
81	Recalculate severity based on chain context:
82
83	Impact Amplifiers:
84	- Self-XSS (Low) + CSRF chain = Stored XSS affecting others (High)
85	- Info disclosure (Low) + credential reuse = Account takeover (Critical)
86	- SSRF (Medium) + cloud metadata = Full infrastructure access (Critical)
87	- IDOR (Medium) + PII access + mass enumeration = Data breach (Critical)
88
89	CVSS Recalculation:
90	For each chain, calculate:
91	- Attack Complexity: Based on number of steps and prerequisites
92	- Privileges Required: Based on initial access requirements
93	- User Interaction: Based on whether victim action is needed
94	- Scope: Changed if chain crosses trust boundaries
95	- Confidentiality/Integrity/Availability impact of the FINAL outcome
96
97	### Step 5: PoC Generation
98
99	```bash
100	python scripts/generate_chain_poc.py --chain {chain_file}
101	```
102
103	For each confirmed chain, generate:
104
105	1. Step-by-step reproduction guide with screenshots descriptions
106	2. Automated PoC script (Python) that:
107	- Executes each step in sequence
108	- Passes data between steps (tokens, cookies, IDs)
109	- Validates each step succeeded before continuing
110	- Generates evidence at each step
111	3. curl command sequence for manual reproduction
112	4. Video script: Narrated steps for recording a PoC video
113
114	### Step 6: Bug Bounty Report Generation
115
116	```bash
117	python scripts/generate_report.py --chains {chains_file} --format {platform}
118	```
119
120	Platform-optimized reports for:
121	- HackerOne format: Title, severity, description, steps to reproduce, impact, remediation
122	- Bugcrowd format: Similar with VRT classification
123	- Generic format: Professional pentest report style
124
125	Report structure per chain:
126	```
127	## Title
128	[Compelling, impact-focused title]
129
130	## Severity
131	[Recalculated sev

People who liked this also viewed

6 picks

Type