What problem does it solve? Enterprise SSO integrations built on SAML often contain subtle assertion trust flaws—unsigned assertions, signature wrapping, weak audience checks—that are easy to miss during manual security testing. This Skill provides a structured playbook for systematically validating SAML assertion trust boundaries. ## Core Features & Use Cases - Signature Validation Testing: Checks for unsigned assertions, wrong signed nodes, and XML signature wrapping (XSW) attacks. - Trust Boundary Auditing: Validates Audience, Recipient, Destination, ACS handling, issuer trust, and replay protections like InResponseTo and NotOnOrAfter. - Account Mapping Review: Detects email-only binding, case folding, and unverified attribute issues that enable account takeover. - Use Case: During a penetration test of an enterprise application using IdP-initiated SSO, capture the SAMLResponse, then follow the triage steps to test altered attributes, assertion placement confusion, and replay against the ACS endpoint. ## Quick Start Analyze the captured SAML login flow for this target and test whether the service provider accepts modified or unsigned assertions. ## Related Skills Pair with XML external entity testing for parser-level attacks and OAuth/OIDC misconfiguration checks for non-SAML SSO flows.
