Verified:GitHub

hunt-saml

Name: hunt-saml
Availability: InStock
Author: marcboggs

Tests SAML and SSO implementations for signature wrapping, comment injection, and assertion manipulation vulnerabilities.

1|Updated Aug 21, 2026

Search Tags:#penetration testing #sso #saml #bug bounty #xxe #account takeover #xml signature wrapping

Ready to run

npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-saml-marcboggs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-saml
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/.claude/skills/hunt-saml
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-saml-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers need a structured methodology to attack SAML-based single sign-on flows, where inconsistent XML parsing between signers and service providers frequently enables account takeover. This Skill provides concrete attack patterns, payload examples, and triage guidance for SAML/SSO bug bounty hunting. ## Core Features & Use Cases - XML Signature Wrapping (XSW1-XSW8): Relocate signed assertions and inject attacker-controlled assertions with altered NameID values while keeping signatures valid. - Signature Stripping & Comment Injection: Remove Signature elements entirely or exploit comment-handling differences (admin@target.com) between XML parsers. - XXE and NameID Manipulation: Test assertion parsers for external entity injection and probe NameID values for admin impersonation or SSTI. - Use Case: During a bug bounty engagement, you intercept a SAMLResponse at /saml/acs, decode it with base64, strip the Signature element, change NameID to [email protected], re-encode, and achieve admin account takeover rated Critical. ## Quick Start Ask the AI to test the target's SAML assertion consumer service endpoint for XML signature wrapping and signature stripping using a captured SAMLResponse.

Frequently Asked Questions about hunt-saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test SAML for XML Signature Wrapping attacks?▼

Capture a valid SAMLResponse, decode it with base64, then inject a second assertion containing an attacker-controlled NameID before the legitimately signed assertion. If the service provider processes the first assertion while the signature validates the second, you achieve account takeover.

What tools are used for SAML security testing?▼

SAMLRaider, a Burp Suite extension available in the BApp Store, automates XSW testing on intercepted SAMLResponses. Manual workflows use base64 decoding, xmllint for formatting, and direct XML editing before re-encoding.

How does SAML signature stripping lead to account takeover?▼

Decode the SAMLResponse, delete the entire Signature element, change the NameID to an admin email, and re-encode. If the service provider does not enforce signature presence, it silently accepts the forged assertion and issues an admin session.

Can SAML assertions be exploited with XXE injection?▼

Yes, SAML assertions are XML, so parsers without disallow-doctype-decl are vulnerable. Injecting a DOCTYPE with an external entity like file:///etc/passwd into the NameID element can leak file contents through error responses or logs.

When is a SAML finding rated Critical versus Informational?▼

Successful XSW or signature stripping enabling arbitrary account takeover rates Critical, while comment injection and XXE rate High. Manipulating only non-security attributes like display name without crossing an authorization boundary is Informational.