Chapter 26 — Methods II
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Chaining"]
N2["26.2 Minimum proof"]
N3["26.3 Documentation"]
N4["26.4 Detection goals"]
N5["26.5 Payment adjacency"]
N6["26.6 No exploit kit"]
N7["26.7 Asset ids in diagrams"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Chaining"]
N2["26.2 Minimum proof"]
N3["26.3 Documentation"]
N4["26.4 Detection goals"]
N5["26.5 Payment adjacency"]
N6["26.6 No exploit kit"]
N7["26.7 Asset ids in diagrams"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Chaining]
|
v
[26.2 Minimum proof]
|
v
[26.3 Documentation]
|
v
[26.4 Detection goals]
|
v
[26.5 Payment adjacency]
|
v
[26.6 No exploit kit]
|
v
[26.7 Asset ids in diagrams]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) chain findings ethically; (2) stop at minimum proof; (3) document chains.
26.1 Chaining
Only inside ROE; stop at impact proof.
A chain is a sequence of allowed steps that together show how a low-privilege foothold can reach a higher-value asset. At Riverstone Transit Bank every link must already be permitted by the rules of engagement; inventing a new hop mid-engagement is out of bounds. The operator stops the moment an impact is proven, because further pivots add risk without adding evidence for the finding. Sam Ito keeps a short list of approved transitions on the method card so a late-night session cannot invent a creative shortcut that nobody signed. Chains that look impressive but rest on an unapproved step are discarded, not celebrated.
26.2 Minimum proof
No extra pivoting "for fun".
Minimum proof means the smallest set of steps that demonstrates the weakness with enough detail for the owner to reproduce it. Extra pivoting after that point is curiosity dressed as thoroughness, and it often expands blast radius without changing the finding. TrackScope records the proof steps; anything beyond them needs a new ticket and a fresh approval. Sam once stopped a junior who wanted to "just see" whether domain admin was reachable after a cross-user read was already on film. The junior's restraint became part of the coaching note, which is more useful than another screenshot of a shell.
26.3 Documentation
Chain diagram in appendix with times.
Every accepted chain ships with a diagram that names each hop, the asset identifiers from FindingsDesk, and the wall-clock time of each transition. Freehand hostnames once broke an appendix link and cost a day of repair; shared ids keep the appendix mechanically checkable. Times matter because detection goals ask whether the SOC saw the stages, and a diagram without clocks cannot answer that. Sam pastes the diagram into the engagement appendix before he files the finding, not after the debrief, so reviewers never chase a missing figure. The diagram is evidence, not decoration.
26.4 Detection goals
Note whether SOC saw stages — purple synergy.
Detection goals turn a red-team chain into purple-team feedback. For each stage Sam records whether PulseMap or the SOC console showed a hit, a miss or an unknown. Unknown is allowed only when no sensor covers that hop, and that gap itself becomes a backlog item. The note is short: technique id, stage name, seen or not, and a pointer to the log source that should have caught it. Purple synergy here is not a joint meeting; it is a habit of leaving the detection team something actionable instead of a victory lap.
26.5 Payment adjacency
Extra approvals before anything payment-near.
Anything that touches payment-adjacent systems at TRB needs a second signature before the chain continues. Payment adjacency includes the SWIFT gateway perimeter, settlement queues and the jump hosts that can reach them, even when the gateway itself stays out of scope. Sam treats "near" as a property of network path and shared credentials, not of the finding title. If a hop would land on a host that can talk to those queues, he pauses, files the request and waits. Skipping the pause once would be enough to end the engagement and the internship.
26.6 No exploit kit
Course still provides no exploit development.
The coursework teaches chaining with published weaknesses and approved tooling; it does not teach writing new exploits. Learners who ask for a kit are pointed back to the method cards and the impact catalogue. That boundary keeps the classroom honest about what a bank will authorize and what a university programme can safely supervise. Sam's own kits are limited to the pinned scripts whose hashes sit in the lab notebook. Building a custom payload for a graded chain is a fail, even if the payload would have worked.
26.7 Asset ids in diagrams
Chain diagrams use the same asset ids as FindingsDesk. Freehand hostnames caused a broken link in an appendix once; ids made the appendix mechanically checkable.
FindingsDesk assigns a stable identifier to every in-scope host and service. Diagrams that reuse those ids can be validated by a script that walks the appendix and confirms each box still exists in the inventory. When Sam used a nickname for a jump host, the appendix checker failed and the finding sat in review until the diagram was redrawn. The lesson stuck: pretty labels belong in the prose caption, not in the graph nodes. Juniors now copy ids from the inventory pane rather than typing from memory.
26.8 Impact catalogue
Allowed impact proofs for chains are catalogued (cross-user read, config change). "Domain admin" is not an allowed classroom impact at TRB.
The impact catalogue is a short, signed list of proofs the classroom will accept. Cross-user read of a non-sensitive record and a reversible configuration change are on it; seizing domain admin, encrypting files or touching live payments are not. The catalogue exists so Sam does not have to invent the boundary under pressure. When a chain could continue toward a forbidden impact, the operator stops and files what is already proven. Ambition that exceeds the catalogue is redirected into a detection goal or a remediation note, not into a riskier hop.
26.9 Stop-on-impact banner
Method cards show a banner "stop when impact proven". Sam measures average steps after impact; fewer is better.
The banner sits at the top of every method card so it is the first line an operator sees when the card is open. Sam tracks how many actions people take after the impact screenshot is already saved. A falling average means the culture is working; a rising average triggers a coaching huddle. The metric is deliberately simple because complicated dashboards invite gaming. Operators who stop cleanly get credited in the engagement summary, which makes restraint visible to the people who write performance notes.
26.10 Stop after cross-user read
After impact proof on cross-user read, Sam's next action is stop, not pivot to admin. His chain appendix's last box is green "STOP — impact shown". Juniors copy the box into their cards.
The scene is the moment everyone remembers: the cross-user read is on screen, the finding draft already names the path, and the temptation to keep going is loud. Sam closes the session, pastes the green STOP box as the final node and archives the notebook. Juniors who watched him do it once start pasting the same box on their own cards. The ritual is small, but it turns an abstract rule into a habit people can imitate under fatigue.
26.11 No ransomware simulations
Impact catalogue forbids ransomware simulation on bank networks in coursework. Someone always asks; the catalogue answers before Sam must.
Learners who come from capture-the-flag culture often assume encryption demos are fair game. At TRB they are not, even in the lab ranges that mirror production naming. The catalogue states the ban in one line so Sam can point at paper instead of arguing taste. Questions about "what if we only encrypt a test share" still get a no, because the classroom cannot afford a story that sounds like ransomware to an auditor. Safer impact proofs already teach the same privilege questions without that theatre.
26.12 Green means restraint
STOP boxes are green on purpose — restraint is success, not failure.
Red usually marks danger; here green marks the successful end of a chain. The colour choice is deliberate pedagogy: stopping is the outcome the programme rewards. Sam explains it once to each cohort and then lets the stickers do the talking. When a visitor asks why the last box is not red, an operator can answer without calling the supervisor. Colour coding that fights the culture fails; colour coding that matches the culture sticks.
26.13 STOP stickers
Green STOP boxes are stickers juniors put on printed cards. Culture is tactile.
Printed method cards still circulate in the jump room because screens go dark and paper does not. Juniors peel a green STOP sticker onto the card the first time they complete a chain under supervision. The sticker is slightly ridiculous and that is the point: it makes the rule memorable and gives peers something to notice during reviews. Sam keeps a spare sheet in the drawer next to the badge printer. When the sheet runs out, someone has been practicing, which is a good problem.
26.14 Impact-then-stop posters
Chain ethics posters hang in the jump room: "Impact then stop". Visitors sometimes laugh; operators do not. Sam watches new contractors read the poster before their first chain.
The poster is not ironic decoration. Contractors who skim it and joke about it still get a verbal brief, but Sam notes who paused long enough to read. People who treat the slogan as a joke tend to be the ones who ask for one more hop after proof. The jump room is where habits form, so the wall carries the same message as the method cards and the catalogue. Consistency across paper, screen and conversation is how the rule survives shift changes.
Worked example (synthetic TRB)
Sam chains unapproved flow + weak session control to show cross-user read risk, then stops.
Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.
Errors and limits
This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.
Exercises
- EX076 — Minimum proof. What does minimum proof mean? Rubric: 3 = stop once impact shown; no extra pivot; 2 = partial; 1 = full takeover always; 0 = none.
- EX077 — Payment-near. What extra step before payment-adjacent tests? Rubric: 3 = extra approvals/ROE check; 2 = partial; 1 = vague; 0 = none.
- EX078 — Chain doc. What belongs in the chain appendix? Rubric: 3 = steps/times/evidence links; 2 = partial; 1 = vague; 0 = none.
Synthesis
Chains stay inside ROE, prove impact minimally and document clearly.
Continue studying — chapter 26 of 40
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →