hunt-saml

Detect SAML vulnerabilities including XML Signature Wrapping and NameID manipulation.

5|Updated May 27, 2026

Search Tags:#security audit #SSO #vulnerability detection #XML #SAML

Ready to run

npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-saml-cybersecwoman

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-saml
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/hunt-saml
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-saml-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires saml-raider, samlmagic, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill uncovers and assesses vulnerabilities in Single Sign-On (SSO) protocols using Security Assertion Markup Language (SAML), targeting attacks such as XML Signature Wrapping, NameID manipulation, and signature stripping.

Core Features & Use Cases

Identifies SAML endpoints: Discovers common SAML endpoints, such as /saml/acs and /Shibboleth.sso.
XML Signature Wrapping attacks: Detects manipulation of SAML assertions to bypass authentication.
NameID Manipulation: Detects changes in user identification data to assume different user roles.
Use Case: A cybersecurity auditor would use this skill to evaluate the security of an organization's SAML implementation during an internal assessment.

Quick Start

Start a manual attack analysis for a SAML endpoint with the following command: ./saml-raider

Frequently Asked Questions about hunt-saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect XML Signature Wrapping vulnerabilities in SAML SSO implementations?▼

To detect XML Signature Wrapping in SAML SSO implementations, you can use automated testing tools like SAMLRaider alongside manual analysis to uncover assertion manipulations that bypass authentication.

What is NameID manipulation in SAML and how can I test for it?▼

NameID manipulation in SAML involves altering user identification data to assume different user roles, and you can test for this security issue by analyzing SAML flows to detect unauthorized changes to user identities.

How do I find common SAML endpoints during a security audit?▼

To find common SAML endpoints during a security audit, you can scan for standard paths such as /saml/acs and /Shibboleth.sso to identify where SAML assertions are processed.

Can I use SAMLRaider for automated SAML vulnerability testing?▼

Yes, you can use SAMLRaider for automated SAML vulnerability testing to identify signature stripping and XML Signature Wrapping issues, supplemented by manual analysis techniques for comprehensive assessment.

What's the best way to prevent signature stripping attacks in SAML flows?▼

The best way to prevent signature stripping attacks in SAML flows is to evaluate your implementation using vulnerability detection tools to ensure assertions are properly signed and validated.

Does SAML vulnerability detection work for internal organizational security assessments?▼

Yes, SAML vulnerability detection is specifically targeted at organizations implementing SAML-based Single Sign-On, making it suitable for cybersecurity auditors evaluating internal security postures.