Hunt authentication bypass vulnerabilities

Exploit SAML/JWT/XMLRPC authentication-bypass vulnerabilities in SSO flows

SSO security testing when SAML signature stripping and parser-differential attacks apply.

• · SAML assertion or JWT token
• · SSO endpoint

• · SAML XSW (XML Signature Wrapping) payload
• · signature-stripping bypass
• · JWT alg-confusion payload

• · Burp SAML editor plugin
• · jwt-forge
• · curl

SAML or JWT-based SSO; no signature validation hardening

SAML validation already implemented (signature validation, namespace checking); parser hardened

• · Built from 12 public HackerOne reports (GitHub Enterprise, Slack, Uber, Rocket.Chat)
• · SAML XSW + signature-stripping + domain-bypass patterns
• · JWT alg-confusion + signature-validation skip