SAML / SSO Attacks
SAML is XML plus cryptography plus a pile of libraries that disagree. Signature wrap and XXE still show up.
Tags: saml, sso, ato, xxe
Level: advanced
Method
Get a trace
Capture an AuthnRequest and a Response. Note the ACS URL, audience, and whether the signature covers the assertion or the whole response.
Tools: Burp Suite
Signature wrap / comment
Two assertions, XML comments in the NameID, changed attributes after a valid signature. Test only on accounts you own.
XXE in the parser
Some IdP/SP stacks still parse DTDs on SAML XML. Canary first.
Tools: interactsh
ACS / Recipient
If Recipient or Destination is not checked, an assertion meant for app A is accepted by app B.
Field notes
- Do not smash a production IdP with XXE file reads of other tenants.
- OIDC is often sitting next to SAML on the same app. Test both.