Saml Sso Assertion Attacks

You'll want this when you're poking at enterprise SSO flows and need to think through SAML trust assumptions systematically. It walks you through signature wrapping, audience restriction bypasses, assertion replay, and the kinds of XML parsing quirks that let you impersonate users across identity provider boundaries. The triage checklist is solid: capture the full round trip, check which nodes are actually signed, test both SP-initiated and IdP-initiated flows, then start swapping attributes and issuers. It's focused on the trust confusion and binding logic that breaks most often in real deployments, not just textbook vulnerabilities.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill saml-sso-assertion-attacks --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: SAML SSO and Assertion Attacks — Signature Validation, Binding, and Trust Confusion

AI LOAD INSTRUCTION: Use this skill when the target uses SAML-based SSO and you need to validate assertion trust: signature coverage, audience and recipient checks, ACS handling, XML parsing weaknesses, and IdP/SP confusion.

1. WHEN TO LOAD THIS SKILL

Load when:

Enterprise SSO uses SAML requests or responses
You see SAMLRequest, SAMLResponse, XML assertions, or ACS endpoints
Login flows involve an external IdP and browser POST/redirect binding

2. HIGH-VALUE MISCONFIGURATION CHECKS

Theme	What to Check
signature validation	unsigned assertion accepted, wrong node signed, signature wrapping
audience and recipient	weak `Audience`, `Recipient`, `Destination`, or ACS validation
issuer trust	wrong IdP accepted or multi-tenant issuer confusion
replay and freshness	missing `InResponseTo`, weak `NotBefore` / `NotOnOrAfter` enforcement
account mapping	email-only binding, case folding, unverified attributes
XML parser behavior	XXE-like parser issues or unsafe transforms around SAML documents