Advanced Offensive Security
OAuth 2.0 & SAML Attacks
Break federated login: redirect_uri abuse, token theft, SAML bypasses.
Modern apps delegate login to OAuth 2.0 / OpenID Connect and SAML (single sign-on). Misconfigurations in these flows lead to full account takeover across many sites at once.
OAuth weaknesses
- Weak redirect_uri validation — steal the authorization code/token by redirecting to an attacker URL.
- Missing/replayed state parameter — enables CSRF on the OAuth flow.
- Leaking tokens in the Referer header or browser history.
- Implicit flow token theft and overly broad scopes.
SAML weaknesses
- XML Signature Wrapping (XSW) — inject an unsigned assertion the app trusts.
- Signature not verified / accepting 'none' — forge the identity assertion.
- Replay of assertions when there's no one-time-use check.