Monday, June 5, 2023

Testing SAML Endpoints For XML Signature Wrapping Vulnerabilities

A lot can go wrong when validating SAML messages. When auditing SAML endpoints, it's important to look out for vulnerabilities in the signature validation logic. XML Signature Wrapping (XSW) against SAML is an attack where manipulated SAML message is submitted in an attempt to make the endpoint validate the signed parts of the message -- which were correctly validated -- while processing a different attacker-generated part of the message as a way to extract the authentication statements. Because the attacker can arbitrarily forge SAML assertions which are accepted as valid by the vulnerable endpoint, the impact can be severe. [1,2,3]

Testing for XSW vulnerabilities in SAML endpoints can be a tedious process, as the auditor needs to not only know the details of the various XSW techniques, but also must handle a multitude of repetitive copy-and-paste tasks and apply the appropriate encoding onto each message. The latest revision of the XSW-Attacker module in our BurpSuite extension EsPReSSo helps to make this testing process easier, and even comes with a semi-automated mode. Read on to learn more about the new release! 

 SAML XSW-Attacker

After a signed SAML message has been intercepted using the Burp Proxy and shown in EsPReSSO, you can open the XSW-Attacker by navigating to the SAML tab and then the Attacker tab.  Select Signature Wrapping from the drop down menu, as shown in the screenshot below:

To simplify its use, the XSW-Attacker performs the attack in a two step process of initialization and execution, as reflected by its two tabs Init Attack and Execute Attack. The interface of the XSW-Attacker is depicted below.
XSW-Attacker overview

The Init Attack tab displays the current SAML message. To execute a signature wrapping attack, a payload needs to be configured in a way that values of the originally signed message are replaced with values of the attacker's choice. To do this, enter the value of a text-node you wish to replace in the Current value text-field. Insert the replacement value in the text-field labeled New value and click the Add button. Multiple values can be provided; however, all of which must be child nodes of the signed element. Valid substitution pairs and the corresponding XPath selectors are displayed in the Modifications Table. To delete an entry from the table, select the entry and press `Del`, or use the right-click menu.

Next, click the Generate vectors button - this will prepare the payloads accordingly and brings the Execute Attack tab to the front of the screen.

At the top of the Execute Attack tab, select one of the pre-generated payloads. The structure of the selected vector is explained in a shorthand syntax in the text area below the selector.
The text-area labeled Attack vector is editable and can be used to manually fine-tune the chosen payload if necessary. The button Pretty print opens up a syntax-highlighted overview of the current vector.
To submit the manipulated SAML response, use Burp's Forward button (or Go, while in the Repeater).

Automating XSW-Attacker with Burp Intruder

Burp's Intruder tool allows the sending of automated requests with varying payloads to a test target and analyzes the responses. EsPReSSO now includes a Payload Generator called XSW Payloads to facilitate when testing the XML processing endpoints for XSW vulnerabilities. The following paragraphs explain how to use the automated XSW attacker with a SAML response.

First, open an intercepted request in Burp's Intruder (e.g., by pressing `Ctrl+i`). For the attack type, select Sniper. Open the Intruder's Positions tab, clear all payload positions but the value of the XML message (the `SAMLResponse` parameter, in our example). Note: the XSW-Attacker can only handle XML messages that contain exactly one XML Signature.
Next, switch to the Payloads tab and for the Payload Type, select Extension-generated. From the newly added Select generator drop-down menu, choose XSW Payloads, as depicted in the screenshot below.

While still in the Payloads tab, disable the URL-encoding checkbox in the Payload Encoding section, since Burp Intruder deals with the encoding automatically and should suffice for most cases.
Click the Start Attack button and a new window will pop up. This window is shown below and is similar to the XSW Attacker's Init Attack tab.

Configure the payload as explained in the section above. In addition, a schema analyzer can be selected and checkboxes at the bottom of the window allow the tester to choose a specific encoding. However, for most cases the detected presets should be correct.

Click the Start Attack button and the Intruder will start sending each of the pre-generated vectors to the configured endpoint. Note that this may result in a huge number of outgoing requests. To make it easier to recognize the successful Signature Wrapping attacks, it is recommended to use the Intruder's Grep-Match functionality. As an example, consider adding the replacement values from the Modifications Table as a Grep-Match rule in the Intruder's Options tab. By doing so, a successful attack vector will be marked with a checkmark in the results table, if the response includes any of the configure grep rules.


EsPReSSO's XSW Attacker is based on the WS-Attacker [4] library by Christian Mainka and the original adoption for EsPReSSO has been implemented by Tim G√ľnther.
Our students Nurullah Erinola, Nils Engelberts and David Herring did a great job improving the execution of XSW and implementing a much better UI.


[1] On Breaking SAML - Be Whoever You Want to Be
[2] Your Software at My Service
[3] Se­cu­ri­ty Ana­ly­sis of XAdES Va­li­da­ti­on in the CEF Di­gi­tal Si­gna­tu­re Ser­vices (DSS)
[4] WS-Attacker

More information

  1. Hacker Tools Online
  2. Tools 4 Hack
  3. Hacker Tools Github
  4. Hacking Tools For Mac
  5. Pentest Tools Kali Linux
  6. Pentest Tools Website
  7. Hacker Tools Mac
  8. Hacking Tools 2019
  9. Pentest Tools Framework
  10. Hacker Tools 2019
  11. Hackrf Tools
  12. Hacking Tools Windows
  13. Termux Hacking Tools 2019
  14. Pentest Tools Review
  15. Pentest Tools Review
  16. Hacker Hardware Tools
  17. Blackhat Hacker Tools
  18. Hack Tools
  19. Pentest Tools Github
  20. Hacking Tools For Games
  21. Pentest Tools Website
  22. Hacker Tools List
  23. World No 1 Hacker Software
  24. Install Pentest Tools Ubuntu
  25. Hack Website Online Tool
  26. Pentest Recon Tools
  27. Pentest Tools Apk
  28. Best Hacking Tools 2019
  29. Hack Tools For Mac
  30. Hacker Tools Free
  31. Blackhat Hacker Tools
  32. Pentest Box Tools Download
  33. New Hacker Tools
  34. Pentest Tools Website Vulnerability
  35. Hacking Tools Mac
  36. Pentest Tools Github
  37. Blackhat Hacker Tools
  38. Hack Tools For Games
  39. Best Pentesting Tools 2018
  40. Hacker Tools For Pc
  41. Termux Hacking Tools 2019
  42. Game Hacking
  43. Hacker Tools For Mac
  44. Hack Tools Github
  45. Hack Tools Github
  46. Hacker Tools List
  47. Pentest Tools Apk
  48. Pentest Automation Tools
  49. Pentest Tools Android
  50. Hacking Tools For Windows Free Download
  51. Underground Hacker Sites
  52. Pentest Tools Linux
  53. Hak5 Tools
  54. World No 1 Hacker Software
  55. Hacking Tools For Beginners
  56. Hacking Tools
  57. Hacking Tools For Windows 7
  58. Hack Tools
  59. Hack Tools For Games
  60. Pentest Tools Find Subdomains
  61. Pentest Recon Tools
  62. Termux Hacking Tools 2019
  63. Nsa Hack Tools Download
  64. Pentest Tools Find Subdomains
  65. Hacker Tools For Ios
  66. Easy Hack Tools
  67. Hack Tools
  68. Hacking Tools Download
  69. Kik Hack Tools
  70. Pentest Tools Framework
  71. Hacker Tools For Ios
  72. Hacker Tools For Windows
  73. Hack Rom Tools
  74. Nsa Hack Tools Download
  75. Pentest Reporting Tools
  76. Hack Apps
  77. Best Hacking Tools 2019
  78. Pentest Tools Kali Linux
  79. Hacker Tool Kit
  80. Hacker Tools Apk
  81. Pentest Tools List
  82. Best Hacking Tools 2019
  83. What Are Hacking Tools
  84. Install Pentest Tools Ubuntu
  85. Hacker Tools Linux
  86. Pentest Tools Website Vulnerability
  87. Hacking Tools For Games
  88. Hacker Tools Linux
  89. Hacker Tools For Mac
  90. New Hacker Tools
  91. Hacker Tools
  92. Hacking Tools Mac
  93. Hacking Tools Software
  94. How To Install Pentest Tools In Ubuntu
  95. Hacking Tools Windows 10
  96. Hacking Tools Pc
  97. Hacking Tools Mac
  98. Hacking Tools Windows
  99. Hacking Tools Kit
  100. Hacker Tool Kit
  101. Tools For Hacker
  102. New Hacker Tools
  103. Hacking Tools Hardware
  104. Hack Website Online Tool
  105. Hack Tools 2019
  106. Best Hacking Tools 2020
  107. Hack Tools Pc
  108. How To Make Hacking Tools
  109. Hacking Tools Hardware
  110. Hack Tools For Windows
  111. Android Hack Tools Github
  112. Hacker Tools Online
  113. Hacker Search Tools
  114. Hacking Apps
  115. Termux Hacking Tools 2019
  116. Pentest Automation Tools
  117. Tools For Hacker
  118. Hackrf Tools
  119. World No 1 Hacker Software
  120. Hack Tools For Ubuntu
  121. Hacker Tools Free Download
  122. Hacker Tools Github
  123. Pentest Tools For Windows
  124. Growth Hacker Tools
  125. Hacker Tools List
  126. Tools For Hacker
  127. Nsa Hack Tools
  128. Pentest Tools Linux
  129. Hacking Apps
  130. Hacking Tools For Mac
  131. Hacking App
  132. Hacker Tools For Ios
  133. Hacker Tools For Ios
  134. Pentest Tools Windows
  135. Android Hack Tools Github
  136. Hacker Tools For Windows
  137. Hackers Toolbox