SAML assertion probes
Lab or test-tenant only. Recipient, Audience, Destination, and comment wrapping. Pair with the XXE canary on the same ACS parser.
Tags: saml, sso, ato, xxe
Controlled probes
Replay a lab assertion at a second ACSDrop AudienceRestriction in a lab-signed assertion<NameID>victim<!-- -->@attacker.example</NameID>DOCTYPE SYSTEM canary on the ACS XML
Source: https://owasp.org/www-community/attacks/SAML_assertion_manipulation