saml-sso-assertion-attacks
yaklang/hack-skills
Test SAML SSO assertion signature validation, binding, and trust boundary flaws in enterprise authentication.
What is saml-sso-assertion-attacks?
SAML SSO assertion attack playbook for testing signature validation, assertion wrapping, audience restrictions, ACS handling, and XML trust boundaries. Use when the target relies on SAML-based single sign-on and you need to validate assertion trust and IdP/SP confusion.
- Check signature validation and coverage across assertion nodes
- Test audience, recipient, and ACS endpoint validation
- Identify issuer trust and multi-tenant confusion issues
- Verify replay protection and freshness constraints (NotBefore/NotOnOrAfter)
- Detect account mapping weaknesses (email-only binding, case folding)
- Assess XML parser behavior and unsafe transforms around SAML documents
How to install saml-sso-assertion-attacks
npx skills add https://github.com/yaklang/hack-skills --skill saml-sso-assertion-attacksHow to use saml-sso-assertion-attacks
- 1.Capture a full login round trip involving SAML requests and responses
- 2.Inspect which XML nodes are signed and which attributes drive account binding
- 3.Compare SP-initiated and IdP-initiated SAML flows for differences
- 4.Test replay attacks by reusing captured SAML assertions
- 5.Attempt to alter assertion attributes and verify validation
- 6.Test assertion wrapping and signature coverage edge cases
- 7.Verify audience, recipient, and ACS endpoint validation logic
Use cases
- Testing enterprise SSO flows that use SAML requests or responses
- Validating assertion trust when login involves external IdP and browser POST/redirect binding
- Comparing SP-initiated and IdP-initiated SAML flows for inconsistencies
- Detecting signature wrapping, assertion placement confusion, and altered attributes
- Identifying weak audience or recipient validation in SAML assertions
- Security testers auditing enterprise SSO implementations
- Penetration testers targeting SAML-based authentication systems
- Application security engineers validating SAML assertion handling
- Identity and access management (IAM) security specialists
saml-sso-assertion-attacks FAQ
Load when the target uses SAML-based SSO, you see SAMLRequest/SAMLResponse in traffic, or login flows involve an external IdP with browser POST/redirect binding.
Key vectors include unsigned assertions, signature wrapping, weak audience/recipient validation, issuer confusion, missing replay protection, and account mapping flaws (email-only binding, case folding).
Capture one full login round trip, inspect which XML nodes are signed and which attributes bind accounts, then compare SP-initiated and IdP-initiated flows.
Use xxe-xml-external-entity for XML parser depth, oauth-oidc-misconfiguration for alternative SSO, and authbypass-authentication-flaws for post-SSO boundary issues.
Full instructions (SKILL.md)
Source of truth, from yaklang/hack-skills.
name: saml-sso-assertion-attacks description: >- SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.
SKILL: SAML SSO and Assertion Attacks — Signature Validation, Binding, and Trust Confusion
AI LOAD INSTRUCTION: Use this skill when the target uses SAML-based SSO and you need to validate assertion trust: signature coverage, audience and recipient checks, ACS handling, XML parsing weaknesses, and IdP/SP confusion.
1. WHEN TO LOAD THIS SKILL
Load when:
- Enterprise SSO uses SAML requests or responses
- You see
SAMLRequest,SAMLResponse, XML assertions, or ACS endpoints - Login flows involve an external IdP and browser POST/redirect binding
2. HIGH-VALUE MISCONFIGURATION CHECKS
| Theme | What to Check |
|---|---|
| signature validation | unsigned assertion accepted, wrong node signed, signature wrapping |
| audience and recipient | weak Audience, Recipient, Destination, or ACS validation |
| issuer trust | wrong IdP accepted or multi-tenant issuer confusion |
| replay and freshness | missing InResponseTo, weak NotBefore / NotOnOrAfter enforcement |
| account mapping | email-only binding, case folding, unverified attributes |
| XML parser behavior | XXE-like parser issues or unsafe transforms around SAML documents |
3. QUICK TRIAGE
- Capture one full login round trip.
- Inspect which XML nodes are signed and which attributes drive account binding.
- Compare SP-initiated and IdP-initiated flows.
- Test replay, altered attributes, and assertion placement confusion.
4. RELATED ROUTES
- XML parser attack depth: xxe xml external entity
- OAuth or OIDC SSO alternatives: oauth oidc misconfiguration
- Auth boundary issues after SSO: authbypass authentication flaws
Related skills
More from yaklang/hack-skills and the wider catalog.
sandbox-escape-techniques
Expert sandbox escape techniques across Python, Lua, seccomp, chroot, Docker, browser, and namespace contexts.
smart-contract-vulnerabilities
Expert audit playbook for Solidity/EVM smart contract vulnerabilities: reentrancy, overflow, access control, delegatecall, MEV, and signature replay.
sqli-sql-injection
Advanced SQL injection exploitation playbook for database attack scenarios.
ssrf-server-side-request-forgery
Expert SSRF attack playbook: URL filter bypass, cloud metadata, protocol exploitation, and blind detection.
ssti-server-side-template-injection
Expert SSTI detection, fingerprinting, and RCE exploitation across Jinja2, FreeMarker, Twig, Velocity, ERB, and more.
stack-overflow-and-rop
Exploit stack overflows via ROP chains, ret2libc, ret2csu, ret2dlresolve, and SROP on Linux binaries.