hunt-saml

Name: hunt-saml
Availability: InStock
Author: entrovyx

Analyze SAMLResponse XML signatures to identify authentication bypass vulnerabilities.

3|1|Updated Jul 2, 2026

Search Tags:#security #authentication #xml #pentesting #sso #saml

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-saml-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-saml
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-saml
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-saml-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the complexity of auditing SAML-based authentication flows, where inconsistent XML parsing and signature validation logic often lead to critical account takeover vulnerabilities.

Core Features & Use Cases

Vulnerability Identification: Detects XML Signature Wrapping (XSW), signature stripping, and comment injection vulnerabilities in SSO implementations.
Exploit Chain Support: Provides templates for advanced bypasses including parser differentials, multi-signature confusion, and XXE injection within SAML assertions.
Use Case: When testing a federated login portal, use this skill to systematically probe for signature validation weaknesses that allow an attacker to impersonate administrative users.

Quick Start

Use the hunt-saml skill to analyze the captured SAMLResponse for XML signature wrapping and parser differential vulnerabilities.

Frequently Asked Questions about hunt-saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test SAML SSO implementations for XML signature wrapping vulnerabilities?▼

To test SAML SSO for XML signature wrapping, analyze the captured SAMLResponse to detect signature validation weaknesses and parser differentials that allow authentication bypasses and account impersonation.

What is the best way to find authentication bypass vulnerabilities in SAML 2.0 federated login portals?▼

Finding authentication bypass vulnerabilities in SAML 2.0 involves probing federated login portals for inconsistent XML parsing and signature stripping that enable privilege escalation and account takeover paths.

Can I use this skill to exploit comment injection and XXE vulnerabilities in SAML assertions?▼

Yes, you can use it to exploit comment injection and XXE vulnerabilities in SAML assertions by applying XML manipulation techniques to validate security assertion integrity and uncover multi-signature confusion flaws.

Do I need to manually intercept traffic to audit SAML signature validation logic?▼

Yes, auditing SAML signature validation requires manual intervention to intercept traffic and apply specific XML manipulation techniques to validate parser behavior and security assertions.

What types of SAML authentication flaws can be identified through XML signature integrity analysis?▼

XML signature integrity analysis identifies SAML authentication flaws including signature stripping, comment injection, parser differentials, and multi-signature confusion within SSO implementations.

Why does inconsistent XML parsing lead to account takeover vulnerabilities in SSO implementations?▼

Inconsistent XML parsing causes account takeover vulnerabilities in SSO implementations because signature validation logic fails to properly verify SAML assertions, allowing attackers to impersonate administrative users.