Hacking SAML

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://oblique.security/blog/hacking-saml
• Blog Title: Hacking SAML
• Suggested Section: Pentesting Web > SAML Attacks; optionally cross-reference Generic Methodologies & Resources > AI Security > AI Assisted Fuzzing And Vulnerability Discovery

🎯 Content Summary

Overview

The post describes an AI-assisted security review of SAML implementations that discovered full authentication bypasses, XML-signature wrapping vulnerabilities, identity-parsing differentials, information disclosure, arbitrary logout, and unauthenticated denial-of-service conditions. The core recurring failure is that XML canonicalization, signature verification, XML parsing, and application-level node selection can interpret the same document differently. A signature verifier...

🔧 Technical Details

Canonicalization-versus-parser differentials: Compare how the canonicalizer, XML-signature library, general XML parser, and application extractor interpret processing instructions, comments, text nodes, namespaces, and mixed content. A vulnerability exists when attacker-controlled XML contributes data to the canonicalized signed representation but is ignored or reconstructed differently during account lookup. For example, <saml:NameID><?p not-an-?>admin@example.com</saml:NameID> can be verified as the signed identity not-an-admin@example.com while application text extraction returns admin@example.com.

XML comment identity manipulation: Insert comments at different positions inside identity-bearing fields such as NameID, then compare the exact string authenticated by signature validation with the string used for user lookup. If one path concatenates text around the comme...

🤖 Agent Actions

Updated src/pentesting-web/saml-attacks/README.md with:

• Processing-instruction and XML-comment identity differentials.
• Verified-node binding and signed error-response testing.
• Wrapping tests for AuthnRequest, AttributeQuery, and LogoutRequest.
• Pre-authentication XSLT transform bombs.
• Systematic XML-signature resource-exhaustion testing.
• Numbered citations to primary advisories/issues and the supplied blog.

Validation completed:

• git diff --check passed.
• Reference numbering and citations verified.
• All added links returned HTTP 200.
• No forbidden sources added.
• mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://oblique.security/blog/hacking-saml

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > SAML Attacks; optionally cross-reference Generic Methodologies & Resources > AI Security > AI Assisted Fuzzing And Vulnerability Discovery".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0