--- title: "Don’t Report Bugs. Chain Them." description: "A weak header, a loose CORS policy and a small injection are low alone. Chaining is how they turn critical, with a demo from HTML injection to RCE." canonical_url: "https://amrelsagaei.com/dont-report-bugs-chain-them" last_updated: "2025-09-13" --- Bug bounty hunting isn’t just about spotting a vulnerability and rushing to hit “Submit.”
The real breakthroughs happen when you stop treating bugs as isolated flaws and start connecting them into something bigger. One broken header.
A misconfigured CORS policy.
A weak injection.
Individually, they may look harmless. But together? They can tear a system wide open. This is vulnerability chaining, and it’s how “informative” bugs become critical reports. --- ## What Is Vulnerability Chaining? Most hunters are trained to see bugs as finished products: *I found an IDOR, I’ll report it.*
But chaining forces a different perspective. The question isn’t *what is this bug?*
The question is *what does this bug enable?* A read-only endpoint might look useless, until it leaks token formats.
A weak CORS policy is just noise, until you match it with an exposed API.
A dashboard XSS might seem contained, until you pair it with CSRF to reach another system. On their own, they’re unremarkable.
Connected together, they’re a breach waiting to happen. --- ## The Mindset Shift: From Reporter to Breaker The biggest mistake hunters make is stopping too soon.
Platforms are flooded with reports like *“Missing Rate Limiting”* or *“Open Redirect, No Impact.”* And most of them are closed as *Informative*. But the real hacker doesn’t ask, *“Is this exploitable?”*
They ask, *“Where does this lead?”* Every rejected bug is a potential building block.
An error message leaking an internal hostname? Recon fuel.
A 403 on an upload endpoint? Maybe the auth check only fails on that method.
A login page with sloppy CORS? Suddenly it’s the perfect partner for an XSS payload. Chaining is about seeing systems, not just issues. It’s about collecting parts of a puzzle and assembling the whole picture. --- ## The Anatomy of a Chain Every effective chain follows the same rhythm: 1. **Entry** – A small crack. An HTML injection, a redirect, or even just a verbose error. 2. **Pivot** – Use it to move sideways. Inject JS, replay requests, or reach a hidden API. 3. **Impact** – Combine everything into a high-severity exploit: account takeover, RCE, or full data exfiltration. A chain isn’t about luck. It’s about engineering flow, connecting weaknesses until the target collapses. --- ## Why Most Hackers Don’t Chain The truth? It’s not laziness.
It’s training. Most guides teach you to label bugs, not to connect them. So hunters stop after the first discovery.
But reports don’t win bounties, stories do. Chaining rewires your thinking: - Can I escalate this beyond the role I tested? - Can I connect it to a misconfiguration? - Does it reveal something I can use elsewhere? - What happens if I change methods or replay the request in another context? Once you start asking these questions, you stop being a participant in bug bounty, and start being a threat to broken systems. --- ## The Chaining Checklist Before you move on from any bug, ask yourself: - Can it reach another endpoint or domain? - Can it break access controls? - Does it combine with weak CORS, redirects, or verb tampering? - Does it reveal sensitive identifiers or tokens? - Can it be replayed in a different role (guest vs admin, mobile vs web)? Every “low” finding is a doorway.
Your job is to test what’s on the other side. --- ## Demo: From HTML Injection to RCE To prove the point, let’s take a simple web app.
Profile pages. Feedback forms. Nothing exciting. Individually, the bugs look dull: an injection here, an error message there.
But linked together? You end up with remote code execution. In the **video above**, I walk through this complete chain step by step, from the first harmless input all the way to RCE. It shows exactly how weak points, when connected, become a full-blown compromise. That’s the power of chaining. It’s not the bugs themselves. It’s the path they create when connected. --- ## Putting It All Together Here’s the takeaway:
Critical findings don’t always start critical.
They’re built through persistence, curiosity, and the ability to see how one weakness leads to another. Where most hunters see “noise,” you should see opportunity.
The difference between an informative report and a critical payout often lies in a single question: *“What does this unlock?”* --- ## Closing Thoughts Bug bounty is no longer about spraying payloads or racing scanners.
The hunters who succeed today are the ones who slow down, think deeper, and connect the dots others miss. Don’t just report bugs. Chain them. ## Sitemap See the full [sitemap](/sitemap.md) for all pages.