SAML ACS and wrapping
Test on an IdP/SP pair you control or a program test tenant. Signature wrapping and Recipient mismatch are parser bugs.
Tags: saml, sso, ato, xxe
Techniques
Recipient / ACS mismatch
Assertion issued for ACS A accepted at ACS B or another tenant.
Replay a lab assertion at a second ACS on the same SP
Audience / Destination
Missing or any-valued AudienceRestriction. Destination not bound to the request URL.
Drop AudienceRestriction in a lab-signed assertion
XML comment wrapping
NameID split with comments so the verifier sees A and the app sees B.
<NameID>victim<!-- -->@attacker.example</NameID> in a lab assertion
XXE on the ACS
Same XML parser may still load a DTD. Canary only.
SAML XML with an external SYSTEM identifier to OAST