saml-security

仓库创建 2026年7月26日最近提交 18 小时前SkillHot 收录 3 小时前

▸ 精选理由

面向企业 SSO，提供针对性攻击检测与修复要点。

这个 Skill 做什么

覆盖 SAML SSO 的签名包裹、未签名断言等安全检测。

针对使用 SAML SSO 的场景做攻击与防护验证，重点找签名包装、未签名断言和注释注入等能伪造认证的 XML 漏洞。通常在企业级单点登录集成或审计时使用，可以检测服务端对断言的错误验证。特别聚焦签名验证、断言完整性和解析逻辑，能把看起来正常但被篡改的认证请求挑出来。

▸ 展开 SKILL.md 英文原文

Use when an app uses SAML SSO — testing for signature-wrapping, unsigned-assertion, and comment-injection attacks that forge authentication, plus correct validation.

研究检索SAMLSSO签名验证通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/11-identity-and-access-management/03-saml-security/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/11-identity-and-access-management/03-saml-security/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

SAML is the XML-based SSO protocol behind a lot of enterprise "log in with your company account". The identity provider signs an assertion vouching for the user; the app (service provider) trusts it. The attacks all target the same weak point: getting the app to accept an assertion it shouldn't — unsigned, tampered, or wrapped. This skill covers those attacks and the validation that stops them.

## When to use it

Any app using SAML for SSO (enterprise apps, federated login). SAML's XML signature model is notoriously easy to implement wrong, so it's high-value to test.

## The attack classes

- **Missing signature validation** — the app accepts an assertion that isn't signed, or

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有