domains / families / security / hunt-saml

hunt-saml

combined

Hunt SAML / SSO attacks. Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID (admin@target.com<!--evil-->@attacker.com → some parsers see admin@target.com), signature stripping (remove Signature element entirely, server should reject but doesn't), key confusion (signed by attacker's IdP, accepted by SP), audience-restriction not validated, replay attack (same Assertion accepted twice within validity window). Tools: SAML Raider Burp extension, samlmagic, manual XML manipulation. Detection: any /saml endpoint, /Shibboleth.sso, /sso/saml/, Microsoft ADFS endpoints. Validate: account takeover via altered NameID, admin role injection via altered AttributeStatement. Use when hunting SSO flows, when SAML AssertionConsumerService is reachable, when chaining IdP-trust to SP-impersonation.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The two copies share the same core SAML attack playbook (XSW, comment injection, signature stripping, XXE, NameID manipulation, tools, and triage), but each contains material steps the other lacks. The uphiago copy adds a detailed 'Fragile Lock' section covering parser differentials, canonicalization mismatches, and multi-signature confusion with a detection script. The sickn33 copy adds a mandatory authorization confirmation gate, explicit legal warnings, and a 'Related Skills & Chains' section that maps SAML bugs to broader ATO and auth-bypass chains. Crowning one copy would hide either the advanced parser-differential techniques or the safety/chain context.