Cybersecurity
Hunt SAML
Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID (admin@target.com<!--evil-->@attacker.com → some parsers see admin@target.com), signature stripping (remove Signature element entirely, server should reject but doesn't), key confusion (signed by attacker's IdP, accepted by SP), audience-restriction not validated, replay attack (same Assertion accepted twice within validity window). Tools: SAML Raider Burp extension, samlmagic, manual XML manipulation. Detection: any /saml endpoint, /Shibboleth.sso, /sso/saml/, Microsoft ADFS endpoints. Validate: account takeover via altered NameID, admin role injection via altered AttributeStatement. Use when hunting SSO flows, when SAML AssertionConsumerService is reachable, when chaining IdP-trust to SP-impersonation.
- Publisher / source
- elementalsouls/Claude-BugHunter (found on GitHub top repositories)
- Upstream record
- elementalsouls/Claude-BugHunter
- Version
- Version 1
- Published
- Publication review
- Approved for publication · recorded passed scan 2026-11-05
- Content fingerprint
37070e08eb1d451408420c76a35cec184b4e9387a404dd512a8a0b7557641f32