SAML SSO Attack Skill

SAML Single Sign-On attack methodology — IdP metadata analysis, XML Signature Wrapping (XSW), signature stripping, comment injection in NameID, and SSO timing-based user enumeration. Confirmed on TARGET_ORG_A (SimpleSAMLphp IdP, 79 XMLRPC methods on WordPress SP), TARGET_ORG_B (Ory Kratos + OIDC), and TARGET_ORG_C (ADFS WS-Trust exposed).

When to Use

• Target uses SSO (redirects to idp., sso., login., auth. subdomains).
• URL contains SAMLRequest= or SAMLResponse= parameter.
• Metadata endpoint accessible at /saml2/idp/metadata.php or /FederationMetadata/2007-06/FederationMetadata.xml.
• After exchange-owa-attack discovers ADFS.

Prerequisites

• curl, python3.
• Target SAML endpoint URLs (from recon or metadata).
• SAML Raider Burp extension for interactive testing (optional).

How to Run