skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-saml

Analyze SAMLResponse XML signatures to identify authentication bypass vulnerabilities.

3|1|Updated Jul 2, 2026
Search Tags:#security#authentication#xml#pentesting#sso#saml
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-saml-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-saml
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-saml
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-saml-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the complexity of auditing SAML-based authentication flows, where inconsistent XML parsing and signature validation logic often lead to critical account takeover vulnerabilities.

Core Features & Use Cases

  • Vulnerability Identification: Detects XML Signature Wrapping (XSW), signature stripping, and comment injection vulnerabilities in SSO implementations.
  • Exploit Chain Support: Provides templates for advanced bypasses including parser differentials, multi-signature confusion, and XXE injection within SAML assertions.
  • Use Case: When testing a federated login portal, use this skill to systematically probe for signature validation weaknesses that allow an attacker to impersonate administrative users.

Quick Start

Use the hunt-saml skill to analyze the captured SAMLResponse for XML signature wrapping and parser differential vulnerabilities.

Frequently Asked Questions about hunt-saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test SAML SSO implementations for XML signature wrapping vulnerabilities?▼

To test SAML SSO for XML signature wrapping, analyze the captured SAMLResponse to detect signature validation weaknesses and parser differentials that allow authentication bypasses and account impersonation.

What is the best way to find authentication bypass vulnerabilities in SAML 2.0 federated login portals?▼

Finding authentication bypass vulnerabilities in SAML 2.0 involves probing federated login portals for inconsistent XML parsing and signature stripping that enable privilege escalation and account takeover paths.

Can I use this skill to exploit comment injection and XXE vulnerabilities in SAML assertions?▼

Yes, you can use it to exploit comment injection and XXE vulnerabilities in SAML assertions by applying XML manipulation techniques to validate security assertion integrity and uncover multi-signature confusion flaws.

Do I need to manually intercept traffic to audit SAML signature validation logic?▼

Yes, auditing SAML signature validation requires manual intervention to intercept traffic and apply specific XML manipulation techniques to validate parser behavior and security assertions.

What types of SAML authentication flaws can be identified through XML signature integrity analysis?▼

XML signature integrity analysis identifies SAML authentication flaws including signature stripping, comment injection, parser differentials, and multi-signature confusion within SSO implementations.

Why does inconsistent XML parsing lead to account takeover vulnerabilities in SSO implementations?▼

Inconsistent XML parsing causes account takeover vulnerabilities in SSO implementations because signature validation logic fails to properly verify SAML assertions, allowing attackers to impersonate administrative users.

Related Skills

Explore More Software Engineering Skills→
sayseven7sayseven7
11

saml-sso-assertion-attacks

Detect SAML assertion trust and validation flaws in SSO flows.

Community
Advanced
sjinkssjinks

security-review-owasp-transaction-authorization

Analyze transaction authorization flows for security weaknesses against OWASP guidance.

Community
Advanced
Obsidian-OwlObsidian-Owl
1

test-skill

Validate YAML frontmatter parsing and workflow scaffolding with a self-contained test skill.

Official
Basic
pdparchitectpdparchitect
13

hunt-saml

Identify SAML and SSO authentication vulnerabilities in XML assertions.

Community
Advanced