CWAP Module 10 drills the skill of chaining low-severity bugs into real impact. Work the mini-chains first (each is a single, isolated pivot), then attempt the methodology lab where you must discover and stitch the whole path together. Every precondition is enforced server-side. Track everything on Progress.
Mini-chains (naked: two bugs, one pivot)
⬜ Leak → IDOR An info leak exposes a victim's object ref; an IDOR on that ref reads their private data.
⬜ XSS → steals CSRF token A reflected XSS in the app's own origin reads the anti-CSRF token out of the DOM, enabling a forged state-change.
⬜ Open redirect → token theft An open redirect on the login return flow forwards the freshly-issued session token to an attacker destination.
Methodology (full multi-step chain to discover)
⬜ own-the-app One small SaaS. The admin-only objective is reachable ONLY by chaining ~3 bugs you must discover yourself. Decoy edges are present - build the graph.