saml-sso-assertion-attacks

SAML signature wrapping bypasses authentication when an application validates a signature on one XML node but trusts unsigned assertion content for user mapping. This Skill detects such signature coverage gaps and XML parser trust boundary weaknesses.

To validate SAMLResponse assertions for replay attacks, enforce InResponseTo constraints and verify time-based conditions like NotBefore and NotOnOrAfter. This Skill checks whether your implementation properly enforces freshness and replay resistance rules.

Audience restriction in SAML ensures assertions target only the intended Service Provider, while ACS validation prevents routing to malicious endpoints. This Skill verifies Audience, Recipient, and Destination fields are strictly enforced for SP and IdP flows.

Yes, you can test both SP-initiated and IdP-initiated SAML flows for trust confusion vulnerabilities. This Skill examines SAMLRequest and SAMLResponse XML targeting ACS endpoints to detect improper trust of assertion contents, signatures, and routing fields.

Email-only account mapping leads to impersonation when applications bind identities to unverified attributes without strict case or normalization checks. This Skill exposes risky account mapping bindings and reliance on unverified SAML assertion attributes.

Relying on XML signature validation alone for SAML security is limited because it does not prevent signature wrapping, assertion replay, or audience restriction bypasses. This Skill stress-tests the complete trust boundary, including routing fields and freshness rules, beyond basic signature checks.