hunt-saml

Identify and exploit SAML vulnerabilities in SP/IdP metadata and ACS/SLO endpoints.

Updated Jul 1, 2026

Search Tags:#vulnerability assessment #saml #xml signature wrapping #ssso #metadata reconnaissance

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-saml-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-saml
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-saml
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-saml-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and exploits SAML and SSO vulnerabilities, allowing security professionals to test for unauthorized access and data breaches in a controlled environment.

Core Features & Use Cases

SAML Attack Identification: Discovers and analyzes SAML vulnerabilities like XML signature wrapping, unsigned assertion acceptance, and certificate/key confusion.
Reconnaissance: Gathers metadata and endpoint information to understand the SAML ecosystem within a target environment.
Use Case: When assessing the security of a service that uses SAML for authentication, use this Skill to uncover potential vulnerabilities in the SAML protocol.

Quick Start

Use the hunt-saml skill to perform reconnaissance on the target system and identify SAML-related vulnerabilities.

Frequently Asked Questions about hunt-saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for SAML XML signature wrapping vulnerabilities during a security assessment?▼

To test for SAML XML signature wrapping vulnerabilities, you must manually input target SP/IdP metadata and ACS/SLO endpoints. The skill then analyzes these inputs to identify assertion manipulation and signature wrapping flaws.

What is SAML metadata reconnaissance and how does it find SSO vulnerabilities?▼

SAML metadata reconnaissance gathers SP/IdP endpoint information to map the target SSO ecosystem. It identifies security gaps like unsigned assertion acceptance and certificate confusion within the SAML authentication flow.

Can I assess SAML assertion manipulation and certificate confusion without automated scanning?▼

Yes, you can assess SAML assertion manipulation and certificate confusion by manually providing target metadata. The skill evaluates these inputs to detect unauthorized access paths and key confusion vulnerabilities.

How do I identify unsigned assertion acceptance in SSO endpoints?▼

To identify unsigned assertion acceptance in SSO endpoints, input the target ACS and SLO URLs. The skill evaluates the endpoint behavior to determine if unsigned assertions are incorrectly accepted.

What target information do I need to provide to assess SAML authentication security?▼

You must provide target SP/IdP metadata and endpoint URLs, specifically ACS and SLO endpoints. This manual input is required to perform reconnaissance and identify SAML vulnerabilities.

Why does SAML signature wrapping allow unauthorized access to service providers?▼

SAML signature wrapping allows unauthorized access when a service provider fails to properly validate the signature location. The skill detects this by testing assertion manipulation against provided SSO endpoints.