Identify SAML and SSO authentication vulnerabilities in XML assertions.
npx skills add https://github.com/pdparchitect/rook --skill hunt-saml-pdparchitect
Please help me install this Agent Skill. Skill: hunt-saml Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-saml Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-saml-pdparchitect
This skill addresses the critical security risks associated with inconsistent XML parsing and improper SAML assertion validation, which often lead to account takeover and authentication bypass vulnerabilities.
Use the hunt-saml skill to analyze the intercepted SAMLResponse for XML Signature Wrapping vulnerabilities and potential account takeover paths.
High-intent search queries and answers about installing and using this skill.
To test SAML assertions for XML Signature Wrapping (XSW), you manually manipulate the XML structure of intercepted SAMLResponse payloads to check if identity providers or service providers validate signatures incorrectly, allowing authentication bypasses.
SAML manipulation can exploit SSO authentication flaws including XML Signature Wrapping, signature stripping, comment injection, and XXE injection to achieve account takeover and bypass authorization boundaries on SAML 2.0 platforms.
Yes, you can audit SSO flows on platforms like Okta and Auth0 to verify if attackers can impersonate administrators by manipulating NameID values and bypassing audience-restriction validation in the SAMLResponse.
To check if a SAML response is vulnerable to XXE injection, you inject external entity definitions into the XML assertion payloads and observe whether the service provider's XML parser processes them, indicating improper external entity handling.
Inconsistent XML parsing leads to SAML account takeover because the identity provider and service provider may interpret the same XML document differently, allowing attackers to inject unsigned malicious assertions while keeping the original signature valid.
ok-helloworldDetect SAML SSO authentication bypass paths from assertion trust misconfigurations.
chatbotkitTest SAML endpoints for XSW, NameID manipulation, signature stripping, and XXE vulnerabilities.
cybersecwomanDetect SAML vulnerabilities including XML Signature Wrapping and NameID manipulation.
EntroVyxDetect XML Signature Wrapping, signature stripping, and user enumeration in SAML SSO implementations.
