Attacking the Authentication Layer – a SAML Use Case

“‘They say only: The Doors of Durin, Lord of Moria. Speak, friend, and enter. [...]’ ‘What does it mean by speak, friend, and enter?’ asked Merry.

‘That is plain enough,’ said Gimli. ‘If you are a friend, speak the password, and the doors will open, and you can enter.’

‘Yes,’ said Gandalf, ‘these doors are probably governed by words.”

J. R. R. Tolkien [1]

Welcome to the third chapter, where we analyze our vulnerable applications with a Capture the Flag (CTF) exercise on Security Assertion Markup Language (SAML).

As Gimli tells Gandalf, you only need to know the password to access it (and we can add the username or other factors). Applications typically solve this problem by requiring the user to identify themself with something that only they know (e.g., a password), something they have (e.g., an OTP), something that...

Technical requirements

You can use the Ubuntu LTS machine that we configured in Chapter 2. In addition, we will install the SAML Raider [4] Burp extension, created by Roland Bischofberger and Emanuel Duss.

Scenario files

To reproduce the scenario in this chapter, you can use the files in the Chapter03 directory in the book repository.

The scenario comprises two Docker machines: one Service Provider and one Identity Provider.

The Doors of Durin SAML login scenario

Inspired by the chapter epigraph, the following scenario unfolds as a CTF game. We modified the Vulnerable SAML App [5], which Travis “yogisec” Lowe developed.

We will step into the shoes of the user, “Gandalf” – part of the user group (species) known as maiar – an unprivileged user. Our challenge lies ahead of us at the Doors of Durin, where we must navigate the complexities of centralized SAML-based authentication.

Our objective? To successfully validate our credentials and gain recognition as part of the “dwarf” species, using different SAML attacks. In other words, we aim to be authenticated as part of the administrator group with a series of privilege escalation vulnerabilities.

Note to chief information security officers (CISOs)

Attacks on SAML are an ever-present topic that critically impacts organizations of all types.

Several Advanced Persistent Threats (APTs) have...

How does SAML work and what are its vulnerabilities?

As we said in the first chapter, when we start to exploit something, we still need to learn how the underlying technology works, so we first look for information about how it works.

Since SAML is an open standard, we can refer to the official website of the task force that developed it and refer to the open source code of major implementations.

A summary follows in the next section, but we advise you to practice searching for information.

What is SAML?

SAML is an XML-based standard for managing federated authentication and authorization, focusing on web SSO. It is the dominant technology for enterprise-level SSO [11].

It was developed by the Security Services Technical Committee (SSTC) of the Organization for the Advancement of Structured Information Standards (OASIS) and is currently at version 2.0.

The Web Browser SSO Profile

SAML can specify different profiles that correspond to different implementation scenarios...

Other authentication methods used with HTTP

This chapter focuses on SAML, but it’s important to note that multiple authentication methods can be used with HTTP. The following are the various ways:

• HTTP authentication methods:
  • Basic [16]: This is the simplest authentication method. In this case, the authentication header sends the username and password encoded in base64.
  • Digest [17]: This method is somewhat similar to basic authentication. However, the difference lies in how the username and password are sent; instead of being encoded, they are sent as a hash.
• HTTPS authentication method:
  • Certificate [18]: This method leverages the features of SSL/TLS. It is unique because not only the server is authenticated but also the client via a particular certificate.
• Application and other protocols for authentication:
  • Form/cookie/token-based: This is a conventional method where the web application receives the credentials, processes them, and sets a token inside a cookie to...

How to discover and exploit vulnerabilities in SAML

Now, we will look for the vulnerabilities we may have on SAML. In the following few pages, we will focus only on the attacks particular to SAML, leaving you with references to use to delve into the others.

In this case, we will pull our checklist from threat modeling and then try the various attacks. Let’s start by installing SAML Raider and see whether everything works with the happy case.

Installing SAML Raider

Follow these steps to install SAML Raider:

1. Run Burp, as specified in the Run section of Chapter 2.
2. From the Burp interface, click on Extensions and then on BApp Store.

Figure 3.2 – BApp Store

3. From the BApp Store screen, use the search form on the right and type in SAML Raider, and then click on SAML Raider on the screen on the left to select it.

Figure 3.3 – Searching for SAML Raider

4. From the screen on the...

Summary

In this chapter, we learned about the significance of the authentication layer and its associated technologies. Additionally, we gained an understanding of SAML, its vulnerabilities, and the tools used to exploit them. We also learned how to identify and exploit common SAML vulnerabilities.

In conclusion, understanding how to attack SSO with SAML is very important, particularly in enterprise contexts.

In the next chapter, we’ll focus on a typical internet-facing web application, looking at common vulnerabilities, pre- or post-authentication.

Further reading

This chapter covered many topics. If you want to go deeper, we’re happy to share some valuable resources with you:

• [1] J. R. R. Tolkien (2012). Lord of the Rings. 01: The Fellowship of the Ring: the first part of The Lord of the Rings. Boston: Mariner Books/Houghton Mifflin Harcourt.
• [2] attack.mitre.org. (n.d.). Exploit Public-Facing Application, Technique T1190 - Enterprise | MITRE ATT&CK. [online] Available at https://attack.mitre.org/techniques/T1190/.
• [3] attack.mitre.org. (n.d.). Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK®. [online] Available at https://attack.mitre.org/techniques/T1078/.
• [4] portswigger.net. (n.d.). SAML Raider. [online] Available at https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e.
• [5] Lowe, T. (2023). yogisec/VulnerableSAMLApp. [online] GitHub. Available at https://github.com/yogisec/VulnerableSAMLApp.
• [6] Lefkowitz, P. (2022). Released: Citrix ADC and Citrix...