skills.rest
Skobyn
SkobynCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-saml

Detect SAML/SSO endpoints and vulnerabilities like XML Signature Wrapping.

Updated Jun 24, 2026
Search Tags:#vulnerability#web security#exploit#sso#saml
One-click install
npx skills add https://github.com/Skobyn/talon --skill hunt-saml-skobyn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-saml
Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-saml
Command: npx skills add https://github.com/Skobyn/talon --skill hunt-saml-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Detects and analyzes SAML/SSO vulnerabilities to improve security posture.

Core Features & Use Cases

  • Detection: Identifies SAML endpoints and vulnerabilities such as XML Signature Wrapping (XSW), comment injection in NameID, signature stripping, and XXE in SAML assertions.
  • Exploitation: Provides attack templates and manual workflow guidance for exploiting detected vulnerabilities.
  • Use Case: When hunting for SSO bugs, the skill helps validate if an endpoint is vulnerable to a specific attack, providing evidence for a potential security issue.

Quick Start

Use the 'hunt-saml' skill to find SAML endpoints in the target application.

Frequently Asked Questions about hunt-saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find SAML endpoints to test for SSO vulnerabilities?▼

SAML vulnerabilities include XML Signature Wrapping (XSW), comment injection in NameID, signature stripping, and XXE in SAML assertions. This skill detects these specific authentication flaws during web application security testing.

How do I exploit an XSW or signature stripping vulnerability in a SAML assertion?▼

SAML vulnerability exploitation requires attack templates and manual workflow guidance tailored to detected flaws. This skill provides targeted exploitation steps for validating authentication vulnerabilities in SSO endpoints.

Can I use this for bug bounty hunting on web applications with SSO?▼

Bug hunters and security professionals testing SSO implementations can use this skill. It identifies SAML endpoints and suggests targeted attacks suitable for application security testing and vulnerability validation.

What is the best way to detect comment injection in a SAML NameID?▼

Detecting comment injection in SAML NameID involves scanning SAML responses for malicious comment syntax within the NameID element. This skill identifies this vulnerability alongside other SSO authentication flaws.

Are there limitations when testing SSO authentication flaws with automated scripts?▼

Limitations of automated SSO testing include missing complex custom application logic or multi-stage authentication flows. This skill provides detection and attack templates but requires manual workflow validation.

Related Skills

Kisilev13Kisilev13

hunt-saml

Detect and exploit SAML/SSO authentication vulnerabilities in web applications.

Community
Advanced
SkobynSkobyn

hunt-auth-bypass

Discover and exploit authentication bypass vulnerabilities in web applications.

Community
Advanced
gerald-icagerald-ica

Burp Suite Web Application Testing

Automate web application security testing with Burp Suite.

Community
Advanced
pdparchitectpdparchitect
13

hunt-saml

Identify SAML and SSO authentication vulnerabilities in XML assertions.

Community
Advanced