Test SAML endpoints for XSW, NameID manipulation, signature stripping, and XXE vulnerabilities.
npx skills add https://github.com/chatbotkit/rook --skill hunt-saml
Please help me install this Agent Skill. Skill: hunt-saml Source: https://github.com/chatbotkit/rook/tree/main/skills/hunt-saml Command: npx skills add https://github.com/chatbotkit/rook --skill hunt-saml
This Skill enables security researchers to identify and validate SAML/SSO vulnerabilities (XML Signature Wrapping, NameID manipulation, signature stripping, and related flaws) to assess federation risk across IdP-SP trust boundaries.
Run a controlled lab test to craft a SAML Response targeting the ACs endpoint and verify which assertion is processed first.
High-intent search queries and answers about installing and using this skill.
NameID manipulation in SAML attacks involves altering the NameID element within the assertion to impersonate users, testing whether the Service Provider properly validates the identity mapping against the IdP-issued credentials.
To test for SAML signature stripping, you remove the signature from a captured SAML response and replay it to the /sso/saml endpoint, observing whether the application still authenticates the user without cryptographic validation.
SAML XXE testing involves injecting malicious external entity payloads into the XML assertion, monitoring for file disclosure or out-of-band interactions to confirm the parser processes untrusted external entities.
SAML endpoint discovery requires identifying the Assertion Consumer Service URL and IdP-SP trust boundaries, often found by intercepting SSO traffic or probing standard paths to map the federated authentication architecture.
When testing SAML vulnerabilities, constraints include isolating tests in controlled lab environments to prevent locking out users and ensuring remediation guidance maps accurately to the specific IdP-SP trust configuration observed.
YlikenAnalyze SAML SSO assertions for signature validation and trust boundary weaknesses.
xalgordAnalyze SAML authentication flows and detect protocol-level vulnerabilities.
uphiagoIdentify and exploit SAML SSO authentication bypass vulnerabilities during penetration tests.
cybersecwomanDetect SAML vulnerabilities including XML Signature Wrapping and NameID manipulation.
