saml-sso-attack

Name: saml-sso-attack
Availability: InStock
Author: entrovyx

Detect XML Signature Wrapping, signature stripping, and user enumeration in SAML SSO implementations.

3|1|Updated Jul 2, 2026

Search Tags:#security #authentication #xml #sso #pentest #saml

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill saml-sso-attack-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: saml-sso-attack
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/auth/saml-sso-attack
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill saml-sso-attack-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3, masscan, subfinder, httpx, nuclei.

What problem does it solve?

This skill automates the complex process of analyzing SAML-based authentication flows to identify misconfigurations and security flaws that could lead to identity impersonation or unauthorized access.

Core Features & Use Cases

Metadata Analysis: Automatically extract signing certificates, entity IDs, and SSO endpoints from IdP metadata.
Vulnerability Testing: Perform XML Signature Wrapping (XSW) analysis, signature stripping checks, and timing-based user enumeration.
Use Case: During a security assessment, use this skill to quickly map out an organization's SAML infrastructure and test for common implementation errors like improper signature validation or SSO bypasses.

Quick Start

Use the saml-sso-attack skill to discover SAML endpoints and extract metadata from the target domain example.com.

Frequently Asked Questions about saml-sso-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test SAML SSO implementations for XML Signature Wrapping vulnerabilities?▼

To test SAML SSO for XML Signature Wrapping, you analyze authentication endpoints and metadata services to detect signature wrapping, signature stripping, and user enumeration vulnerabilities. This process targets identity providers and service providers to identify security misconfigurations like improper signature validation.

What security misconfigurations can be found in SAML Single Sign-On endpoints?▼

SAML Single Sign-On security misconfigurations include XML Signature Wrapping (XSW), signature stripping, and timing-based user enumeration. These flaws occur in identity providers and service providers when improper signature validation allows identity impersonation or SSO bypasses.

How do I extract signing certificates and SSO endpoints from IdP metadata?▼

Extracting signing certificates, entity IDs, and SSO endpoints from IdP metadata involves automated analysis of SAML authentication flows. By parsing the metadata services of the target domain, you can map out the organization's SAML infrastructure and identify its configuration details.

Do I need python3 and curl to perform SAML authentication analysis?▼

Yes, performing SAML authentication analysis requires curl, python3, and standard XML parsing libraries. These tools execute the discovery and exploitation procedures needed to analyze SAML Single Sign-On implementations and detect security flaws.

What is the best way to automate SAML vulnerability testing during a pentest?▼

The best way to automate SAML vulnerability testing is using a skill that performs metadata analysis, XSW checks, signature stripping detection, and user enumeration. This maps SAML infrastructure and tests for implementation errors that could lead to unauthorized access.

Why does SAML signature stripping allow SSO bypasses?▼

SAML signature stripping allows SSO bypasses because the service provider fails to properly validate the signature on the authentication response. This security misconfiguration in the SAML implementation means attackers can modify the response to impersonate users without invalidating the authentication flow.