web-vuln-saml-sso

What this skill does

Detects vulnerabilities in SAML-based Single Sign-On implementations by intercepting and manipulating SAML responses. Tests for XML Signature Wrapping (XSW variants XSW1–XSW8), signature removal/stripping, NameID comment injection, SAML replay attacks, XXE in SAML responses, and Assertion Consumer Service (ACS) URL manipulation.

When to use

• When auditing a web application that uses SAML 2.0 for authentication or federation
• When testing an Identity Provider (IdP) or Service Provider (SP) for SSO weaknesses
• When evaluating whether SAML signature validation can be bypassed to authenticate as an arbitrary user
• When checking for XML-level injection or replay vulnerabilities in SSO flows

Prerequisites

• curl must be installed
• base64 (GNU coreutils) must be available
• xmllint (from libxml2-utils) must be installed for XML parsing: apt install libxml2-utils
• Ability to intercept and replay SAML responses (browser proxy or captured assertion)
• A valid SAML response from a legitimate authentication flow