Never Break the Chain: Attack Chaining for 0-Days

Erica frames the talk around automating exploit chains, where several small weaknesses, some newly found, combine into one serious compromise. She argues that a low-severity finding becomes critical once paired with another flaw, and that a clear business impact, such as server takeover, is easier to get accepted.

Her cases come from real engagements and bug bounty work, with details redacted. An admin panel accepting Java archive uploads let her run code, and the process reported system-level rights, a reminder that environment data can mislead testers. Cross-site scripting fed a Windows batch script for command injection. A report generator that trusted client-side content led to a shell, and an unsupported comment plugin with a hardcoded key let her spoof users. A path traversal flag overwrote site content, and unsalted, reused password hashes paired with SQL injection granted admin access. Error-based injection got past keyword filters, with help from a language model suggesting alternative syntax.

The defensive takeaways are to restrict uploads and control egress, prefer allowlists, avoid hardcoded keys and home-grown crypto, salt hashes, retire unsupported software, and layer filtering. She closes by discussing bug bounty negotiation and vulnerability disclosure programs.