Recently found a SAML vulnerability, any website that allows users to configure SAML also takes a x509 certificate as input there will be an implicit trust between IDP and SP. (You can easily perform an account takeover via using your own x509 cert, Signed saml response with the victim's email)

Also SAML can be used for session hijacking/login csrf

- User is entering his credit card details while attacker's site is open
- Attacker swaps the session using SAML session hijacking and now card details will be saved in attacker's account

⚔️ The Hunt Begins.

Admissions are now open for all Brut Security courses.

📅 Next Batch: 17 August
📩 DM to enroll wa.link/brutsecurity