🌶 SAML-ATTACKS

SAML is an XML SSO standard; the Identity Provider (IdP) signs an assertion the
Service Provider (SP) trusts. Attacks target signature verification, XML
canonicalisation and trust boundaries. Authorized testing only.

- Find SP metadata:   /saml/metadata , /sp/metadata , /simplesaml/ , /adfs/ls/
- Decode the SAMLRequest/SAMLResponse (URL-decode -> base64-decode -> inflate):
    echo "$B64" | base64 -d | python3 -c "import sys,zlib;sys.stdout.buffer.write(zlib.decompress(sys.stdin.buffer.read(),-15))"
  (Redirect binding = deflate+base64+urlencode; POST binding = base64 only.)
- Note bindings (Redirect vs POST), NameID format, whether assertions/response
  are signed, and the signing cert.

Goal: get the SP to validate a signature over the original assertion but process
an attacker-controlled forged assertion. Variants XSW1-XSW8 differ by where the
forged/original elements and Signature's Reference URI are placed.
  - XSW1/2: wrap at Response signature level.
  - XSW3-6: inject a forged Assertion as sibling/child; original kept for the
    signature reference.
  - XSW7/8: abuse Extensions / Object elements.
Tool: SAML Raider (Burp extension) -> "XSW" buttons apply each variant; also
clones/edits the signing cert. Try all 8; success = authenticated as the
attacker-chosen NameID.

- Strip the <ds:Signature> element entirely; some SPs "fail open" and accept
  unsigned assertions.
- Change which element is signed (sign Response only, inject unsigned Assertion,
  or vice versa).

- Self-sign a forged assertion and attach your own cert in KeyInfo; vulnerable
  SPs trust the embedded cert instead of the pinned IdP cert.
- Key confusion / algorithm downgrade; try "none"-style acceptance.
- SAML Raider: "Remove Signatures", "Edit", "Send Certificate", "Resign".

- NameID / attribute injection -> change email/UPN to a privileged user.
- Audience/Recipient/Destination not validated -> token replay across SPs.
- Missing NotOnOrAfter / replay (no InResponseTo check) -> capture & replay.
- Comment-in-NameID (XML canonicalisation): admin@x.com<!---->.evil.com parsed
  differently by verifier vs app (CVE-2017-11427-class / "SAML canonicalization").
- SSRF via AssertionConsumerServiceURL / RelayState open redirect.

SAML Raider (Burp)         # XSW, cert cloning, resign
samltools / samltool.com   # decode, verify, build (use local copy for real data)
python3-saml / xmlsec test harness for the SP's own validation logic