saml-sso-attack

SAML SSO Attack Skill

SAML Single Sign-On attack methodology — IdP metadata analysis, XML Signature Wrapping (XSW), signature stripping, comment injection in NameID, and SSO timing-based user enumeration. Confirmed on TARGET_ORG_A (SimpleSAMLphp IdP, 79 XMLRPC methods on WordPress SP), TARGET_ORG_B (Ory Kratos + OIDC), and TARGET_ORG_C (ADFS WS-Trust exposed).

When to Use

• Target uses SSO (redirects to idp., sso., login., auth. subdomains).
• URL contains SAMLRequest= or SAMLResponse= parameter.
• Metadata endpoint accessible at /saml2/idp/metadata.php or /FederationMetadata/2007-06/FederationMetadata.xml.
• After exchange-owa-attack discovers ADFS.

Prerequisites

• curl, python3.
• Target SAML endpoint URLs (from recon or metadata).
• SAML Raider Burp extension for interactive testing (optional).

How to Run

# Discover SAML IdP metadata
curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/saml2/idp/metadata.php" | python3 -c "
import sys, base64, zlib
from xml.etree import ElementTree as ET
content = sys.stdin.read()
if 'EntityDescriptor' in content:
    root = ET.fromstring(content)
    for el in root.iter():
        if 'entityID' in el.attrib:
            print(f'entityID: {el.attrib[\"entityID\"]}')
"

# Decode SAMLRequest from URL
echo "SAMLREQUEST_BASE64" | python3 -c "
import sys, base64, zlib
raw = base64.b64decode(sys.stdin.read().strip())
decompressed = zlib.decompress(raw, -15)
print(decompressed.decode())
"

Quick Reference