hunt-saml

Detect SAML/SSO endpoints and vulnerabilities like XML Signature Wrapping.

Updated Jun 24, 2026

Search Tags:#vulnerability #web security #exploit #sso #saml

Ready to run

npx skills add https://github.com/Skobyn/talon --skill hunt-saml-skobyn

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-saml
Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-saml
Command: npx skills add https://github.com/Skobyn/talon --skill hunt-saml-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Detects and analyzes SAML/SSO vulnerabilities to improve security posture.

Core Features & Use Cases

Detection: Identifies SAML endpoints and vulnerabilities such as XML Signature Wrapping (XSW), comment injection in NameID, signature stripping, and XXE in SAML assertions.
Exploitation: Provides attack templates and manual workflow guidance for exploiting detected vulnerabilities.
Use Case: When hunting for SSO bugs, the skill helps validate if an endpoint is vulnerable to a specific attack, providing evidence for a potential security issue.

Quick Start

Use the 'hunt-saml' skill to find SAML endpoints in the target application.

Frequently Asked Questions about hunt-saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find SAML endpoints to test for SSO vulnerabilities?▼

SAML vulnerabilities include XML Signature Wrapping (XSW), comment injection in NameID, signature stripping, and XXE in SAML assertions. This skill detects these specific authentication flaws during web application security testing.

How do I exploit an XSW or signature stripping vulnerability in a SAML assertion?▼

SAML vulnerability exploitation requires attack templates and manual workflow guidance tailored to detected flaws. This skill provides targeted exploitation steps for validating authentication vulnerabilities in SSO endpoints.

Can I use this for bug bounty hunting on web applications with SSO?▼

Bug hunters and security professionals testing SSO implementations can use this skill. It identifies SAML endpoints and suggests targeted attacks suitable for application security testing and vulnerability validation.

What is the best way to detect comment injection in a SAML NameID?▼

Detecting comment injection in SAML NameID involves scanning SAML responses for malicious comment syntax within the NameID element. This skill identifies this vulnerability alongside other SSO authentication flaws.

Are there limitations when testing SSO authentication flaws with automated scripts?▼

Limitations of automated SSO testing include missing complex custom application logic or multi-stage authentication flows. This skill provides detection and attack templates but requires manual workflow validation.