<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-saml-configurations
description: >-
  Audit SAML 2.0 SSO implementations for signature wrapping, XML injection,
  assertion replay, certificate validation bypass, and identity provider
  misconfiguration vulnerabilities.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - saml
  - sso
  - xml-signature
  - signature-wrapping
  - saml-raider
  - burp-suite
  - federation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1606.002"]
---

# Auditing SAML Configurations

## Overview

SAML 2.0 is the dominant enterprise SSO protocol but suffers from implementation
complexity that creates exploitable flaws. XML Signature Wrapping (XSW) attacks
manipulate assertion structure while preserving valid signatures. Other vectors
include comment injection in NameID parsing, certificate rollover gaps, assertion
replay without audience/time validation, and IdP metadata poisoning.

Mode: `[MODE: RED]` for SAML exploitation; `[MODE: BLUE]` for configuration hardening.

MITRE ATT&CK: T1606.002 (Forge Web Credentials: SAML Tokens)

## Prerequisites

- Burp Suite with SAMLRaider extension
- `xmlsec1` for XML signature verification
- Python 3.10+ with `lxml`, `signxml`
- Access to SAML metadata endpoints (SP and IdP)
- Test accounts on target SSO implementation

## Key Concepts

### SAML Attack Taxonomy

| Attack | Description | Severity |
|--------|-------------|----------|
| XML Signature Wrapping (XSW) | Move signed assertion, inject unsigned one | Critical |
| Comment Injection | Insert XML comment in NameID to alter parsing | Critical |
| Certificate Confusion | SP accepts assertion signed by wrong cert | Critical |
| Assertion Replay | Reuse captured SAML assertion | High |
| Recipient Mismatch | Assertion accepted by wrong SP | High |
| Missing Audience | No AudienceRestriction validation | Medium |
| Expired Assertion | NotOnOrAfter not validated | Medium |
| Unsigned Assertion | SP accepts unsigned SAML response | Critical |

### XML Signature Wrapping Variants

```
XSW1: Move Signature, copy assertion into new unsigned element
XSW2: Detach Signature from assertion, wrap with evil assertion
XSW3: Insert evil assertion before signed assertion
XSW4: Insert evil assertion as sibling to signed
XSW5: Move signed assertion into Extensions element
XSW6: Insert evil assertion into signature's Object element
XSW7: Insert evil Extensions element with assertion
XSW8: Append evil assertion after Signature
```

### Testing with SAMLRaider

```
1. Intercept SAML Response in Burp
2. Send to SAMLRaider tab
3. Apply XSW attack variants (1-8)
4. Modify NameID to target user
5. Forward modified response
6. Check if SP accepts forged identity
```

### Comment Injection

```xml
<!-- Original NameID -->
<NameID>admin@target.com</NameID>

<!-- Comment injection -->
<NameID>admin@target.com<!---->.evil.com</NameID>
<!-- Some parsers read: admin@target.com -->
<!-- Others read: admin@target.com.evil.com -->
```

## Workflow

### Step 1: Collect SAML Metadata

```bash
# Download SP metadata
curl -s https://app.target.com/saml/metadata > /tmp/sp_metadata.xml

# Download IdP metadata
curl -s https://idp.target.com/metadata > /tmp/idp_metadata.xml

# Extract certificates
xmllint --xpath "//*[local-name()='X509Certificate']/text()" /tmp/idp_metadata.xml > /tmp/idp_cert.pem
```

### Step 2: Analyze Configuration

```bash
node scripts/agent.js --sp-metadata /tmp/sp_metadata.xml \
  --idp-metadata /tmp/idp_metadata.xml --output /tmp/saml_findings.json
```

### Step 3: Test Signature Validation

```bash
# Verify assertion signature
xmlsec1 --verify --pubkey-cert-pem /tmp/idp_cert.pem /tmp/saml_response.xml

# Test if unsigned assertions accepted
# Remove Signature element from SAML response, replay

# Test certificate confusion
# Sign assertion with self-generated certificate, check if SP validates
```

### Step 4: Test Assertion Controls

```bash
# Replay captured assertion after expiry
# Modify Recipient URL and replay
# Remove AudienceRestriction and replay
# Modify NotOnOrAfter to future date and replay
```

## Detection

```yaml
title: Auditing Saml Configurations Detection
id: 157e6534-5579-493b-aa7f-544233a36a42
status: experimental
description: Detects suspicious activity related to auditing saml configurations techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1606.002
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

- [ ] SP validates XML signature on both Response and Assertion elements
- [ ] All 8 XSW attack variants rejected
- [ ] Comment injection in NameID does not alter parsed identity
- [ ] SP validates certificate against pinned/expected IdP certificate
- [ ] NotOnOrAfter enforced with clock skew tolerance ≤5 minutes
- [ ] AudienceRestriction validated against SP entity ID
- [ ] Recipient URL validated against ACS URL
- [ ] InResponseTo validated against outstanding AuthnRequest IDs
- [ ] Assertion replay detected and rejected

## References

- [OWASP SAML Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html)
- [SAMLRaider — Burp Extension](https://github.com/CompassSecurity/SAMLRaider)
- [MITRE ATT&CK T1606.002](https://attack.mitre.org/techniques/T1606/002/)
- [On Breaking SAML — Research Paper](https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/somorovsky)
