skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

saml-sso-attack

Identify and exploit SAML SSO authentication bypass vulnerabilities during penetration tests.

1.1k|191|Updated Jun 24, 2026
Search Tags:#sso#penetration-testing#saml#user-enumeration#adfs#xml-signature#simplesamlphp
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill saml-sso-attack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: saml-sso-attack
Source: https://github.com/uphiago/recon-skills/tree/main/auth/saml-sso-attack
Command: npx skills add https://github.com/uphiago/recon-skills --skill saml-sso-attack

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the challenge of identifying and exploiting common SAML SSO authentication bypass vulnerabilities that are often missed in standard web application penetration tests, allowing security teams to validate the security of identity and access management implementations.

Core Features & Use Cases

  • SAML Endpoint Discovery: Automatically identifies common SAML IdP and SP endpoints across multiple platforms including SimpleSAMLphp, ADFS, Keycloak, and Shibboleth.
  • Metadata & Payload Analysis: Extracts and parses IdP metadata, decodes base64-encoded SAML requests and responses to identify misconfigurations.
  • Attack Vector Testing: Covers timing-based user enumeration, XML Signature Wrapping (XSW), signature stripping, and comment injection attacks for user impersonation.
  • Use Case: A pentester testing an organization that uses SAML SSO for internal tool access can use this Skill to quickly identify exposed ADFS WS-Trust endpoints or vulnerable signature validation that allows unauthorized access to user accounts.

Quick Start

Use the saml-sso-attack skill to enumerate valid users on the target SSO login endpoint and test for XML Signature Wrapping vulnerabilities on the identified SAML Service Provider.

Frequently Asked Questions about saml-sso-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for XML Signature Wrapping vulnerabilities in SAML SSO?▼

XML Signature Wrapping testing checks if a SAML Service Provider validates signature placement correctly. This Skill automates XSW, signature stripping, and comment injection attack testing to identify user impersonation flaws across platforms like SimpleSAMLphp and ADFS.

How do I enumerate valid users on an ADFS or SimpleSAMLphp login endpoint?▼

Timing-based user enumeration measures response delays on SSO login endpoints to identify valid accounts. This Skill performs enumeration against SAML identity providers like ADFS and SimpleSAMLphp during authorized penetration testing engagements.

Can I use this to analyze base64-encoded SAML responses and extract identity provider certificates?▼

Yes, SAML payload analysis decodes base64-encoded SAML requests and responses to extract identity provider certificates. This Skill parses metadata to identify misconfigurations and validate signature implementation weaknesses for remediation documentation.

What SAML SSO authentication bypass techniques should I test during a penetration test?▼

Common SAML SSO bypass techniques include XML Signature Wrapping, signature stripping, and comment injection. This Skill automates testing these attack vectors to detect unauthorized access vulnerabilities in identity and access management implementations.

Does this Skill work with Keycloak and Shibboleth identity providers?▼

Yes, SAML endpoint discovery and attack testing support Keycloak and Shibboleth identity providers. This Skill covers endpoint discovery, metadata analysis, and vulnerability testing across SimpleSAMLphp, ADFS, Keycloak, and Shibboleth platforms.

Related Skills

Explore More Software Engineering Skills→
dakshrawat298-gifdakshrawat298-gif

security-burpsuite-project-parser

Parse Burp Suite XML exports to extract and deduplicate security findings.

Community
Intermediate
yhy0yhy0
74

go-vuln-crypto-tls

Audit Go code for TLS, JWT, SAML, and cryptographic vulnerabilities.

Community
Advanced
zebbernzebbern
4.5k

Burp Suite Web Application Testing

Automate Burp Suite web application security testing across intercept, modify, scan, and manual workflows.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

oauth-attacks

Automate OAuth 2.0 and OpenID Connect vulnerability exploitation during authorized penetration tests.

Official
Advanced