cross-attack-chains

1# Cross-Attack Chains
2 
3An attack chain is a sequence of verified security behaviors in which each step
4provides a prerequisite for the next. Several findings on the same target do
5not form a chain unless the dependency between them is demonstrated.
6 
7## When to Use
8 
9- Two or more validated findings affect the same trust boundary.
10- One finding exposes an identity, token, route, host, or capability needed by
11  another.
12- A report needs to distinguish standalone impact from compound impact.
13- The next chain step cannot be tested safely and must be labeled inferred.
14 
15## Prerequisites
16 
17- Captured evidence and negative controls for every component finding.
18- Current authorization for the compound test and any increased side effects.
19- Approved identities, synthetic records, callbacks, and cleanup procedure.
20- A clear stop condition for sensitive data, availability, or scope changes.
21 
22## How to Run
23 
24Create a chain record beneath the target output directory:
25 
26```bash
27TARGET_ID="example-test"
28OUTPUT_DIR="${OUTPUT_DIR:-./output}"
29CHAIN_DIR="$OUTPUT_DIR/$TARGET_ID/chains"
30 
31mkdir -p "$CHAIN_DIR"
32touch "$CHAIN_DIR/EXPLOIT_CHAINS.md"
33```
34 
35Use evidence states consistently:
36 
37| State | Meaning |
38|---|---|
39| Observed | Present in captured output |
40| Confirmed | Security impact reproduced with a control |
41| Inferred | Plausible dependency that has not been tested |
42| Not tested | Excluded by scope, safety, or missing prerequisites |
43 
44## Procedure
45 
46### 1. Normalize Component Findings
47…