domains / families / security / saml-sso-attack

saml-sso-attack

separate

Attack SAML SSO via XSW, signature strip, metadata extract.

When to use

• Target uses SSO (redirects to `idp.`, `sso.`, `login.`, `auth.` subdomains).
• URL contains `SAMLRequest=` or `SAMLResponse=` parameter.
• Metadata endpoint accessible at `/saml2/idp/metadata.php` or `/FederationMetadata/2007-06/FederationMetadata.xml`.
• After `exchange-owa-attack` discovers ADFS.

Skill page

Source