skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

saml-sso-assertion-attacks

Detect SAML SSO authentication bypass paths from assertion trust misconfigurations.

241|28|Updated May 20, 2026
Search Tags:#sso#saml#xml security#audience restriction#assertion validation#signature wrapping#acs endpoint
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill saml-sso-assertion-attacks-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: saml-sso-assertion-attacks
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/saml-sso-assertion-attacks
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill saml-sso-assertion-attacks-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps identify and exploit SAML SSO misconfigurations that allow forged or improperly validated assertions to bypass authentication or weaken tenant/account binding.

Core Features & Use Cases

  • Signature and coverage validation: Check whether the system correctly verifies the signed XML node(s), handles signature wrapping, and rejects unsigned or incorrectly scoped signatures.
  • Audience, recipient, and ACS handling: Validate strict enforcement of Audience, Recipient/Destination, and ACS/endpoint constraints across SP-initiated and IdP-initiated flows.
  • Trust boundary and replay controls: Assess issuer trust correctness, multi-tenant confusion, and freshness requirements such as InResponseTo and NotBefore/NotOnOrAfter.
  • Account mapping correctness: Evaluate whether security decisions rely on unverified attributes (e.g., email-only binding, case/normalization issues).
  • XML parsing robustness: Review risky parsing/transformation behavior around SAML documents to prevent trust confusion caused by parser differences.

Quick Start

Use this skill to analyze a captured SAML login exchange and produce a prioritized test plan focused on signature validation, audience/recipient checks, ACS endpoint enforcement, and replay/freshness verification.

Frequently Asked Questions about saml-sso-assertion-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test SAML SSO authentication bypass vulnerabilities?▼

SAML SSO authentication bypass testing involves checking signed node coverage, signature wrapping resistance, and strict enforcement of Audience, Recipient, Destination, and ACS endpoint constraints across SP and IdP initiated flows.

What is a SAML signature wrapping attack?▼

A SAML signature wrapping attack exploits XML signature validation flaws by manipulating the document structure so the signature verifies correctly but the application processes unintended unsigned assertion nodes, bypassing authentication trust boundaries.

How do I validate SAML Audience and ACS endpoint restrictions?▼

Validating SAML Audience and ACS endpoint restrictions requires checking that the Service Provider strictly enforces Audience, Recipient, Destination, and ACS endpoint constraints to prevent assertion replay or cross-tenant confusion in SP and IdP initiated flows.

Can I use this SAML security check for enterprise multi-tenant login flows?▼

Yes, this SAML security check applies to enterprise multi-tenant login flows by evaluating issuer trust correctness, multi-tenant confusion risks, and account mapping correctness to prevent unverified attribute binding and case normalization issues.

Why does my SAML XML parser allow assertion trust confusion?▼

SAML XML parser trust confusion occurs when risky parsing or transformation behavior handles SAML documents differently across libraries, allowing forged or improperly validated assertions to bypass authentication boundaries.

What is the best way to verify SAML replay freshness and InResponseTo bindings?▼

Verifying SAML replay freshness requires systematically checking InResponseTo bindings and time bounds like NotBefore and NotOnOrAfter to ensure assertions cannot be reused across authentication sessions.

Related Skills

Explore More Software Engineering Skills→
sayseven7sayseven7
11

saml-sso-assertion-attacks

Detect SAML assertion trust and validation flaws in SSO flows.

Community
Advanced
AJBcodingAJBcoding
4

moai-security-auth

Implement MFA, WebAuthn, OAuth 2.1, and JWT-based authentication with NextAuth.js 5.x.

Community
Advanced
EntroVyxEntroVyx
3

saml-sso-attack

Detect XML Signature Wrapping, signature stripping, and user enumeration in SAML SSO implementations.

Community
Advanced
bpnrockstarbpnrockstar

hunt-saml

Identify and exploit SAML vulnerabilities in SP/IdP metadata and ACS/SLO endpoints.

Community
Advanced