hunt-saml

Name: hunt-saml
Availability: InStock
Author: ChatBotKit

Test SAML endpoints for XSW, NameID manipulation, signature stripping, and XXE vulnerabilities.

13|2|Updated Jun 1, 2026

Search Tags:#sso #pentest #saml #xxe #xsw #nameid #signature-stripping

Ready to run

npx skills add https://github.com/chatbotkit/rook --skill hunt-saml

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-saml
Source: https://github.com/chatbotkit/rook/tree/main/skills/hunt-saml
Command: npx skills add https://github.com/chatbotkit/rook --skill hunt-saml

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables security researchers to identify and validate SAML/SSO vulnerabilities (XML Signature Wrapping, NameID manipulation, signature stripping, and related flaws) to assess federation risk across IdP-SP trust boundaries.

Core Features & Use Cases

Attack patterns: XML Signature Wrapping (XSW), NameID manipulation, signature stripping, and XXE in SAML assertions.
Endpoint discovery & testing: identify critical SAML endpoints such as /saml/acs, /sso/saml, and IdP/SP configurations to validate resilience.
Triage & remediation guidance: provide steps to reproduce in controlled environments and map mitigation strategies.

Quick Start

Run a controlled lab test to craft a SAML Response targeting the ACs endpoint and verify which assertion is processed first.

Frequently Asked Questions about hunt-saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for XML Signature Wrapping vulnerabilities in SAML responses?▼

NameID manipulation in SAML attacks involves altering the NameID element within the assertion to impersonate users, testing whether the Service Provider properly validates the identity mapping against the IdP-issued credentials.

What is signature stripping in SAML and how do I test for it?▼

To test for SAML signature stripping, you remove the signature from a captured SAML response and replay it to the /sso/saml endpoint, observing whether the application still authenticates the user without cryptographic validation.

Can I use XXE attacks against SAML endpoints to extract sensitive data?▼

SAML XXE testing involves injecting malicious external entity payloads into the XML assertion, monitoring for file disclosure or out-of-band interactions to confirm the parser processes untrusted external entities.

How do I discover SAML endpoints for SSO penetration testing?▼

SAML endpoint discovery requires identifying the Assertion Consumer Service URL and IdP-SP trust boundaries, often found by intercepting SSO traffic or probing standard paths to map the federated authentication architecture.

What are the limitations of testing SAML SSO flaws in authorized penetration tests?▼

When testing SAML vulnerabilities, constraints include isolating tests in controlled lab environments to prevent locking out users and ensuring remediation guidance maps accurately to the specific IdP-SP trust configuration observed.