saml-sso-assertion-attacks

To test SAML SSO assertions for signature wrapping and replay attacks, execute a full login round trip to verify signature presence, correct node signing, InResponseTo enforcement, and NotBefore/NotOnOrAfter boundaries. This identifies assertion wrapping and replay weaknesses.

Preventing issuer confusion in SAML SSO deployments requires validating issuer trust, audience restrictions, and ACS endpoint bindings. These checks ensure assertions bind to the correct Service Provider and prevent IdP/SP confusion in multi-tenant environments.

SAML signature validation handles incorrect signed nodes by verifying signature presence and correctness across the assertion and response. Proper node signing ensures the signature covers the intended XML elements, preventing assertion manipulation and bypass vulnerabilities.

Yes, you can use this skill to test XML parser behavior for XXE-like weaknesses in SAML processing. It evaluates parser configurations and XML handling to identify potential vulnerabilities in SAML request and response parsing.

The best way to compare SP-initiated vs IdP-initiated SAML flows is to execute both round trips and document findings. Triage guidance helps differentiate flow behaviors and identify trust boundary misconfigurations in staging environments.