saml-sso-attack

What problem does it solve?

This Skill solves the challenge of identifying and exploiting common SAML SSO authentication bypass vulnerabilities that are often missed in standard web application penetration tests, allowing security teams to validate the security of identity and access management implementations.

Core Features & Use Cases

• SAML Endpoint Discovery: Automatically identifies common SAML IdP and SP endpoints across multiple platforms including SimpleSAMLphp, ADFS, Keycloak, and Shibboleth.
• Metadata & Payload Analysis: Extracts and parses IdP metadata, decodes base64-encoded SAML requests and responses to identify misconfigurations.
• Attack Vector Testing: Covers timing-based user enumeration, XML Signature Wrapping (XSW), signature stripping, and comment injection attacks for user impersonation.
• Use Case: A pentester testing an organization that uses SAML SSO for internal tool access can use this Skill to quickly identify exposed ADFS WS-Trust endpoints or vulnerable signature validation that allows unauthorized access to user accounts.

Quick Start

Use the saml-sso-attack skill to enumerate valid users on the target SSO login endpoint and test for XML Signature Wrapping vulnerabilities on the identified SAML Service Provider.