saml-sso-assertion-attacks

To detect SAML signature wrapping vulnerabilities, you must inspect which XML nodes are signed and verify if the Service Provider processes unsigned assertion elements. This Skill analyzes signature coverage to identify misplaced signatures and wrapping attack vectors.

SAML assertion validation is the process of verifying signature coverage, audience restrictions, and recipient checks in SSO responses. It matters because weak validation allows attackers to forge assertions, bypass authentication, and gain unauthorized access.

Test ACS endpoint and recipient validation by capturing a SAML login round-trip and manipulating the Destination and Recipient attributes. This Skill checks whether the Service Provider strictly enforces ACS handling and rejects mismatched assertions.

Yes, this Skill works with both SP-initiated and IdP-initiated SSO login flows. It analyzes SAMLRequest and SAMLResponse messages and validates issuer trust, audience enforcement, and InResponseTo handling across both flow types.

Check SAML replay attacks and token freshness by validating the NotBefore, NotOnOrAfter, and InResponseTo attributes within the captured assertion. This Skill verifies strict freshness validation to prevent replaying intercepted login tokens.

A limitation of SAML assertion attack detection is that it requires capturing a complete SAML login round-trip first, meaning it cannot passively discover flaws without active traffic interception and assessment during penetration tests.