What problem does it solve? Security testers need systematic guidance to find and validate SAML/SSO implementation flaws—such as XML Signature Wrapping, signature stripping, and comment injection—that lead to account takeover, but these attacks require deep knowledge of XML parser behavior and canonicalization mismatches. ## Core Features & Use Cases - Attack Pattern Library: Covers XSW1–XSW8 variants, comment injection in NameID, signature stripping, key confusion, XXE in assertions, and replay attacks with concrete payload examples. - Endpoint Discovery & Triage: Provides automated SAML endpoint discovery (ADFS, Shibboleth, Keycloak, SimpleSAMLphp), IdP metadata extraction, and severity triage guidance for each finding. - Use Case: During a bug bounty engagement, you intercept a SAMLResponse at /saml/acs, strip the Signature element, change the NameID to admin@company.com, re-encode, and confirm the SP accepts it—demonstrating a Critical account takeover. ## Quick Start Ask the agent to hunt for SAML and SSO vulnerabilities on the target by discovering SAML endpoints and testing captured assertions for signature wrapping, stripping, and NameID manipulation.
