agentsclimarketplace

Saml sso assertion attacks

Skill ShulkwiSEC/bb-huge/skills/curated/saml-sso-assertion-attacks

bb-huge 🤗 , Personal bug bounty findings hub and bug bounty orchestration for multiple agents

Install
npx -y skills add ShulkwiSEC/bb-huge --skill saml-sso-assertion-attacks

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.

SKILL.md

2.0 KB, as published. Nobody here has run it

SKILL: SAML SSO and Assertion Attacks — Signature Validation, Binding, and Trust Confusion

AI LOAD INSTRUCTION: Use this skill when the target uses SAML-based SSO and you need to validate assertion trust: signature coverage, audience and recipient checks, ACS handling, XML parsing weaknesses, and IdP/SP confusion.

1. WHEN TO LOAD THIS SKILL

Load when:

  • Enterprise SSO uses SAML requests or responses
  • You see SAMLRequest, SAMLResponse, XML assertions, or ACS endpoints
  • Login flows involve an external IdP and browser POST/redirect binding

2. HIGH-VALUE MISCONFIGURATION CHECKS

ThemeWhat to Check
signature validationunsigned assertion accepted, wrong node signed, signature wrapping
audience and recipientweak Audience, Recipient, Destination, or ACS validation
issuer trustwrong IdP accepted or multi-tenant issuer confusion
replay and freshnessmissing InResponseTo, weak NotBefore / NotOnOrAfter enforcement
account mappingemail-only binding, case folding, unverified attributes
XML parser behaviorXXE-like parser issues or unsafe transforms around SAML documents

3. QUICK TRIAGE

  1. Capture one full login round trip.
  2. Inspect which XML nodes are signed and which attributes drive account binding.
  3. Compare SP-initiated and IdP-initiated flows.
  4. Test replay, altered attributes, and assertion placement confusion.

4. RELATED ROUTES

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.