skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

saml-sso-assertion-attacks

Detect SAML SSO assertion trust and signature validation weaknesses.

5|2|Updated May 16, 2026
Search Tags:#sso#saml#xml parsing#assertion#account mapping#signature validation#audience restriction
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill saml-sso-assertion-attacks-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: saml-sso-assertion-attacks
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/saml-sso-assertion-attacks
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill saml-sso-assertion-attacks-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SAML SSO assertion attacks help you identify broken trust decisions in enterprise login flows where signature validation, binding attributes, and XML handling can be misconfigured or confused.

Core Features & Use Cases

  • Signature validation testing: Evaluate whether the application correctly enforces which XML nodes are signed and prevents signature wrapping or bypass cases.
  • Audience/recipient and ACS validation checks: Verify strict enforcement of Audience, Recipient/Destination, and ACS endpoints across SP-initiated and IdP-initiated flows.
  • Replay, freshness, and mapping verification: Check enforcement of InResponseTo, NotBefore/NotOnOrAfter constraints, and whether account mapping relies on trustworthy attributes.

Quick Start

Use the saml-sso-assertion-attacks skill to triage a captured SAMLResponse by validating signature coverage, audience/recipient/ACS constraints, freshness fields, and account-binding attributes in one analysis pass.

Frequently Asked Questions about saml-sso-assertion-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test SAML SSO assertion signature validation for wrapping or bypass flaws?▼

Analyze signed node coverage within the SAMLResponse to detect signature wrapping or bypass cases that enable unauthorized login manipulation across enterprise IdPs and SP ACS endpoints.

What is SAML signature wrapping and how does it bypass authentication?▼

SAML signature wrapping exploits occur when an application validates a signed XML node but processes a different unsigned malicious assertion, bypassing authentication trust boundaries in IdP-initiated or SP-initiated login flows.

How do I verify audience restriction and ACS endpoint enforcement in a SAML response?▼

Check strict validation of Audience, Recipient, Destination, and ACS endpoint attributes in both SP-initiated and IdP-initiated SAML flows to verify audience restriction and ACS enforcement.

Can I check SAML replay protection and account mapping integrity in one analysis pass?▼

Evaluate InResponseTo, NotBefore, NotOnOrAfter constraints, and whether account mapping relies on trustworthy attributes to check SAML replay protection and account mapping integrity in one analysis pass.

Does SAML SSO security testing require safe XML parsing behavior checks?▼

SAML SSO security testing requires safe XML parsing behavior checks to ensure the application securely processes SAMLRequest and SAMLResponse XML structures without exposing vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
ok-helloworldok-helloworld
241

saml-sso-assertion-attacks

Detect SAML SSO authentication bypass paths from assertion trust misconfigurations.

Community
Advanced
utsavthakurutsavthakur

saml-sso-assertion-attacks

Validate SAML SSO assertions for signature and audience trust flaws.

Community
Advanced
yaklangyaklang
1.6k

saml-sso-assertion-attacks

Validate SAML assertions for signature coverage, audience checks, and ACS handling.

Official
Advanced
YlikenYliken
5

saml-sso-assertion-attacks

Analyze SAML SSO assertions for signature validation and trust boundary weaknesses.

Community
Advanced