attacking-saml

Attacking SAML

SAML security is XML signature validation, and XML signatures are notoriously hard to validate correctly. The assertion is signed — but which element is signed, what the XML parser reads, and what the application ultimately trusts can be three entirely different things. That gap is XML Signature Wrapping, and it is the reason SAML breaks far more often than its cryptography suggests.

Only against systems you are authorized to test.

When to Use

• A request or redirect carries a SAMLRequest or SAMLResponse parameter
• Base64 (plus DEFLATE for the redirect binding) decodes to XML containing <saml:Assertion>, <samlp:Response>, or <saml:Subject>
• The target exposes a /saml/acs, /sso, /saml2/acs, or /Shibboleth.sso Assertion Consumer Service endpoint
• An IdP-initiated login POSTs an assertion straight to the SP with no prior AuthnRequest
• Federation runs through Okta, ADFS, PingFederate, Azure/Entra, Shibboleth, SimpleSAMLphp, or Keycloak
• You control a low-privilege federated account and want to reach another identity or role

When NOT to Use

• The SSO flow is OAuth 2.0 or OpenID Connect (code, id_token, access_token, /authorize, /.well-known/openid-configuration) — use attacking-oauth-oidc
• The token is a JWT (eyJ... with dot separators) rather than signed XML — use attacking-jwt
• General web testing with no SAML artifact in scope — use testing-web-applications
• Golden SAML against a compromised AD FS server or cloud tenant where you already hold the token-signing key — that is a tenant-takeover play in attacking-entra-id
• Evaluating the signature primitives themselves (SHA-1 vs SHA-256, RSA key size, canonicalization algorithm choice) — use reviewing-cryptography

Decode and Inspect

Everything starts with reading the message. The wire format depends on the binding.

# HTTP-Redirect binding: base64 then raw DEFLATE (no zlib header)
echo 'fVLLbtsw...' | base64 -d | python3 -c \
  "import sys,zlib; sys.stdout.write(zlib.decompress(sys.stdin.buffer.read(),-15).decode())"

# HTTP-POST binding: plain base64, no deflate
echo 'PHNhbWxwOl...' | base64 -d | xmllint --format -