Chapter 40 — Hands-on: chain bugs into account takeover or RCE

Brief

Do a realistic advanced assessment: against a target you deploy (so you can also fix it), find and chain at least three of this Part's bug classes into a single critical outcome — full account takeover or remote code execution — then write the report and remediate the chain, proving each link is broken.

Setup

   * A deliberately-vulnerable modern app you control. Options:
     - PortSwigger's "Gin & Juice Shop" (hosted target for practice) +
       your own instrumented copy of a stack.
     - Build "SecureShop-vuln": a small app that INTENTIONALLY contains a
       handful of this Part's bugs (an image-proxy SSRF, a Node service
       with `lodash.merge`, an XML import with DTDs on, a gift-card
       redeem with a check-then-act race, a Jinja2 `from_string`, an
       upload that shells to ImageMagick, a SAML SP on an old library).
       The guide repo has a starter.
   * Proxy: Burp Suite (Repeater/Turbo Intruder/Collaborator/extensions:
     HTTP Request Smuggler, Param Miner, DOM Invader, SAMLRaider, JWT
     Editor).

Tasks

   1. RECON & MAP (Ch 0.2 methodology + G1 Ch 48)
      - full crawl through the proxy; enumerate endpoints, params, formats,
        the SSO flow, the upload paths, the internal calls you can infer.
      - note every place user input reaches a parser, a template, a
        sub-request, a serializer, or a shared "once" operation.

   2. FIND (at least 5 findings spanning >= 4 of this Part's chapters)
      [ ] request smuggling OR cache poisoning/deception
      [ ] XXE OR SSRF (with a real internal impact, e.g. metadata / an
          internal admin endpoint)
      [ ] prototype pollution OR deserialization OR SSTI (an RCE-class
          bug)
      [ ] a web race condition
      [ ] a file-upload / parser bug
      [ ] a federated-identity flaw (SAML XSW / OAuth redirect_uri or
          account-linking / JWT)

   3. CHAIN (the point of the exercise)
      Build ONE narrative that chains >= 3 findings into ATO or RCE, e.g.:
        cache-poison an XSS onto the login page -> steal an OAuth `code`
        via a redirect_uri quirk -> link to an admin account (unverified
        email) -> admin panel -> SSTI in the "email template" feature ->
        RCE on the notification worker -> read DB creds -> dump another
        tenant's data.
      OR:
        SSRF in the image proxy -> internal metadata endpoint -> a leaked
        internal service token -> the XML import endpoint -> blind XXE
        exfil of a config secret -> reuse it -> deserialization sink ->
        RCE.
      Diagram the chain as an attack path (Ch 1).

   4. REPORT (professional, per G1 Ch 48 template + the chain)
      - exec summary (5 sentences), the chain diagram, per-finding
        sections (CVSS + business impact, repro steps with evidence, root
        cause, remediation, references), and a "kill the chain" section
        naming the single cheapest fix that breaks it.

   5. REMEDIATE & RE-TEST
      - fix EVERY link in the chain (not just one), each with the
        chapter's recommended control.
      - re-run the full chain: it must fail at the first link, and each
        subsequent link independently.
      - add a regression test per fix.

Deliverable

~/sec-lab/adv/reports/p6-webchain.md: the recon notes, the 5+ findings, the chain diagram and narrative, the full report, and the re-test showing the chain dead at every link. Plus: "which single control, added first, would have prevented the whole chain, and why."

Definition of done

• At least 5 findings across at least 4 of this Part's chapters, each with reproducible evidence.
• A working chain of at least 3 findings ending in ATO or RCE, diagrammed as an attack path.
• A report a stranger could act on, with CVSS, root cause, and remediation per finding, plus a "cheapest fix that breaks the chain".
• Every link remediated with the correct control; re-test shows the chain broken at each link.
• A regression test per fix.

Rubric (/100)

   Finding coverage & correctness ............. 20
   Evidence quality (reproducible) ........... 10
   The CHAIN: plausible, well-diagrammed,
     genuinely critical ...................... 25
   Report professionalism .................... 15
   Remediation uses the right control per link  20
   Re-test proves every link broken + tests ... 10