mirror of
https://github.com/carlospolop/hacktricks
synced 2025-02-16 22:18:27 +00:00
35 lines
1.9 KiB
Markdown
35 lines
1.9 KiB
Markdown
|
# SAML Attacks
|
|||
|
|
|
|||
|
|
## Basic Information
|
|||
|
|
|
|||
|
|
Security Assertion Markup Language \(SAML\) is an open standard that allows identity providers \(IdP\) to pass authorization credentials to service providers \(SP\). What that jargon means is that you can **use one set of credentials to log into many different websites**. It’s much simpler to manage one login per user than it is to manage separate logins to email, customer relationship management \(CRM\) software, Active Directory, etc.
|
|||
|
|
|
|||
|
|
SAML transactions use Extensible Markup Language \(XML\) for standardized communications between the identity provider and service providers. SAML is the link between the authentication of a user’s identity and the authorization to use a service. \(From [here](https://www.varonis.com/blog/what-is-saml/)\)
|
|||
|
|
|
|||
|
|
### SAML vs. OAuth
|
|||
|
|
|
|||
|
|
OAuth is a slightly newer standard that was co-developed by Google and Twitter to enable streamlined internet logins. OAuth uses a similar methodology as SAML to share login information. **SAML provides more control** to enterprises to keep their SSO logins more secure, whereas **OAuth is better on mobile and uses JSON**.
|
|||
|
|
|
|||
|
|
### Flow
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## Attacks
|
|||
|
|
|
|||
|
|
### Tampering with data
|
|||
|
|
|
|||
|
|
The request number 5 from the previous image sends back the information from the identity provider to the service provider. This information is **usually signed** at the end of the message so **no tampering with the information is possible**. It's recommended to check what happens in case the information is sent **stripping the signature** from the message.
|
|||
|
|
|
|||
|
|
### Burp Extension
|
|||
|
|
|
|||
|
|
{% embed url="https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e" %}
|
|||
|
|
|
|||
|
|
#### Tutorial
|
|||
|
|
|
|||
|
|
{% embed url="https://epi052.gitlab.io/notes-to-self/blog/2019-03-13-how-to-test-saml-a-methodology-part-two/" %}
|
|||
|
|
|
|||
|
|
{% embed url="https://www.economyofmechanism.com/github-saml" %}
|
|||
|
|
|
|||
|
|
|
|||
|
|
|