skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

saml

Analyze SAML authentication flows and detect protocol-level vulnerabilities.

846|152|Updated Mar 13, 2026
Search Tags:#metadata#pentesting#saml#binding#idp#assertion#golden-saml
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill saml
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: saml
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/protocols/saml
Command: npx skills add https://github.com/xalgord/xalgorix --skill saml

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security engineers and penetration testers identify and analyze protocol-level vulnerabilities in SAML authentication flows, including malformed assertions, metadata weaknesses, and binding-specific weaknesses, enabling authorized validation and remediation of SAML deployments.

Core Features & Use Cases

  • Flow Analysis: Decode and inspect SP-initiated and IdP-initiated SAMLRequest and SAMLResponse payloads to verify InResponseTo, assertion conditions, and signature placement.
  • Metadata & Certificate Extraction: Extract and analyze SP/IdP metadata to find exposed ACS endpoints, signing certificates, and entity IDs useful for golden SAML assessments or misconfiguration checks.
  • Binding-Specific Testing: Differentiate testing approaches for HTTP-POST and HTTP-Redirect bindings including deflate/base64 decoding and injection surfaces.
  • Use Case: During an authorized penetration test, use this Skill to decode a captured SAMLResponse, validate its signature and timestamps, and enumerate metadata for missing protections or exploitable endpoints.

Quick Start

Analyze the provided SAMLResponse and SP/IdP metadata and list any assertion signature issues, missing InResponseTo checks, or binding-specific misconfigurations that could be exploited.

Frequently Asked Questions about saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decode and analyze a captured SAMLResponse during a penetration test?▼

To decode a SAMLResponse during a penetration test, this Skill performs assertion decoding, deflate/base64 handling for Redirect binding, and extracts metadata to inspect signature placement and assertion conditions for exploitable vulnerabilities.

What is a golden SAML attack and how do I assess metadata for it?▼

A golden SAML attack forges assertions using extracted IdP signing certificates. This Skill performs metadata certificate extraction and entity ID enumeration to assess golden SAML vulnerabilities and identify exposed ACS endpoints.

How do I test SAML binding-specific misconfigurations in HTTP-POST and HTTP-Redirect flows?▼

Testing SAML binding misconfigurations requires differentiating approaches for HTTP-POST and HTTP-Redirect. This Skill handles deflate/base64 decoding for Redirect bindings and identifies injection surfaces for both SP-initiated and IdP-initiated flows.

Can I use this to find missing InResponseTo checks in SP-initiated SAML flows?▼

Yes, you can find missing InResponseTo checks in SP-initiated SAML flows. This Skill analyzes SAMLRequest and SAMLResponse payloads to verify InResponseTo values, assertion conditions, and signature placement to detect protocol-level weaknesses.

What SAML metadata weaknesses should I look for during security hardening?▼

During SAML security hardening, you should look for exposed ACS endpoints, extracted signing certificates, and entity IDs in metadata. This Skill analyzes SP/IdP metadata to find misconfigurations useful for golden SAML assessments and remediation.

Related Skills

Explore More Software Engineering Skills→
ok-helloworldok-helloworld
241

saml-sso-assertion-attacks

Detect SAML SSO authentication bypass paths from assertion trust misconfigurations.

Community
Advanced
chatbotkitchatbotkit
13

hunt-saml

Test SAML endpoints for XSW, NameID manipulation, signature stripping, and XXE vulnerabilities.

Official
Advanced
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
bpnrockstarbpnrockstar

hunt-auth-bypass

Detect and exploit authentication bypass vulnerabilities in SAML, JWT, and legacy protocols.

Community
Advanced