skills.rest
marcboggs
marcboggsCOMMUNITY
Explore all skills by this author →
GitHub

hunt-saml

Tests SAML and SSO implementations for signature wrapping, comment injection, and assertion manipulation vulnerabilities.

1|Updated Aug 21, 2026
Search Tags:#penetration testing#sso#saml#bug bounty#xxe#account takeover#xml signature wrapping
One-click install
npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-saml-marcboggs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-saml
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/.claude/skills/hunt-saml
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-saml-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers need a structured methodology to attack SAML-based single sign-on flows, where inconsistent XML parsing between signers and service providers frequently enables account takeover. This Skill provides concrete attack patterns, payload examples, and triage guidance for SAML/SSO bug bounty hunting. ## Core Features & Use Cases - XML Signature Wrapping (XSW1-XSW8): Relocate signed assertions and inject attacker-controlled assertions with altered NameID values while keeping signatures valid. - Signature Stripping & Comment Injection: Remove Signature elements entirely or exploit comment-handling differences (admin<!--x-->@target.com) between XML parsers. - XXE and NameID Manipulation: Test assertion parsers for external entity injection and probe NameID values for admin impersonation or SSTI. - Use Case: During a bug bounty engagement, you intercept a SAMLResponse at /saml/acs, decode it with base64, strip the Signature element, change NameID to admin@company.com, re-encode, and achieve admin account takeover rated Critical. ## Quick Start Ask the AI to test the target's SAML assertion consumer service endpoint for XML signature wrapping and signature stripping using a captured SAMLResponse.

Frequently Asked Questions about hunt-saml

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test SAML for XML Signature Wrapping attacks?▼

Capture a valid SAMLResponse, decode it with base64, then inject a second assertion containing an attacker-controlled NameID before the legitimately signed assertion. If the service provider processes the first assertion while the signature validates the second, you achieve account takeover.

What tools are used for SAML security testing?▼

SAMLRaider, a Burp Suite extension available in the BApp Store, automates XSW testing on intercepted SAMLResponses. Manual workflows use base64 decoding, xmllint for formatting, and direct XML editing before re-encoding.

How does SAML signature stripping lead to account takeover?▼

Decode the SAMLResponse, delete the entire Signature element, change the NameID to an admin email, and re-encode. If the service provider does not enforce signature presence, it silently accepts the forged assertion and issues an admin session.

Can SAML assertions be exploited with XXE injection?▼

Yes, SAML assertions are XML, so parsers without disallow-doctype-decl are vulnerable. Injecting a DOCTYPE with an external entity like file:///etc/passwd into the NameID element can leak file contents through error responses or logs.

When is a SAML finding rated Critical versus Informational?▼

Successful XSW or signature stripping enabling arbitrary account takeover rates Critical, while comment injection and XXE rate High. Manipulating only non-security attributes like display name without crossing an authorization boundary is Informational.

Related Skills

Explore More Software Engineering Skills→
sayseven7sayseven7
11

saml-sso-assertion-attacks

Detect SAML assertion trust and validation flaws in SSO flows.

Community
Advanced
bitcoin-is-moneybitcoin-is-money
6

security-audit

Identify and document security vulnerabilities in BIM's codebase with severity ratings.

Official
Advanced
Renzo-TognellaRenzo-Tognella

testing-api-authentication-weaknesses

Test API authentication mechanisms for token validation and session flaws.

Community
Advanced
pdparchitectpdparchitect
13

hunt-saml

Identify SAML and SSO authentication vulnerabilities in XML assertions.

Community
Advanced