Testing SAML Endpoints For XML Signature Wrapping Vulnerabilities

Posted by iNoticiero on jueves, 20 de agosto de 2020 0

A lot can go wrong when validating SAML messages. When auditing SAML endpoints, it's important to look out for vulnerabilities in the signature validation logic. XML Signature Wrapping (XSW) against SAML is an attack where manipulated SAML message is submitted in an attempt to make the endpoint validate the signed parts of the message -- which were correctly validated -- while processing a different attacker-generated part of the message as a way to extract the authentication statements. Because the attacker can arbitrarily forge SAML assertions which are accepted as valid by the vulnerable endpoint, the impact can be severe. [1,2,3]

Testing for XSW vulnerabilities in SAML endpoints can be a tedious process, as the auditor needs to not only know the details of the various XSW techniques, but also must handle a multitude of repetitive copy-and-paste tasks and apply the appropriate encoding onto each message. The latest revision of the XSW-Attacker module in our BurpSuite extension EsPReSSo helps to make this testing process easier, and even comes with a semi-automated mode. Read on to learn more about the new release! 

 SAML XSW-Attacker

After a signed SAML message has been intercepted using the Burp Proxy and shown in EsPReSSO, you can open the XSW-Attacker by navigating to the SAML tab and then the Attacker tab.  Select Signature Wrapping from the drop down menu, as shown in the screenshot below:



To simplify its use, the XSW-Attacker performs the attack in a two step process of initialization and execution, as reflected by its two tabs Init Attack and Execute Attack. The interface of the XSW-Attacker is depicted below.
XSW-Attacker overview

The Init Attack tab displays the current SAML message. To execute a signature wrapping attack, a payload needs to be configured in a way that values of the originally signed message are replaced with values of the attacker's choice. To do this, enter the value of a text-node you wish to replace in the Current value text-field. Insert the replacement value in the text-field labeled New value and click the Add button. Multiple values can be provided; however, all of which must be child nodes of the signed element. Valid substitution pairs and the corresponding XPath selectors are displayed in the Modifications Table. To delete an entry from the table, select the entry and press `Del`, or use the right-click menu.

Next, click the Generate vectors button - this will prepare the payloads accordingly and brings the Execute Attack tab to the front of the screen.

At the top of the Execute Attack tab, select one of the pre-generated payloads. The structure of the selected vector is explained in a shorthand syntax in the text area below the selector.
The text-area labeled Attack vector is editable and can be used to manually fine-tune the chosen payload if necessary. The button Pretty print opens up a syntax-highlighted overview of the current vector.
To submit the manipulated SAML response, use Burp's Forward button (or Go, while in the Repeater).

Automating XSW-Attacker with Burp Intruder

Burp's Intruder tool allows the sending of automated requests with varying payloads to a test target and analyzes the responses. EsPReSSO now includes a Payload Generator called XSW Payloads to facilitate when testing the XML processing endpoints for XSW vulnerabilities. The following paragraphs explain how to use the automated XSW attacker with a SAML response.

First, open an intercepted request in Burp's Intruder (e.g., by pressing `Ctrl+i`). For the attack type, select Sniper. Open the Intruder's Positions tab, clear all payload positions but the value of the XML message (the `SAMLResponse` parameter, in our example). Note: the XSW-Attacker can only handle XML messages that contain exactly one XML Signature.
Next, switch to the Payloads tab and for the Payload Type, select Extension-generated. From the newly added Select generator drop-down menu, choose XSW Payloads, as depicted in the screenshot below.



While still in the Payloads tab, disable the URL-encoding checkbox in the Payload Encoding section, since Burp Intruder deals with the encoding automatically and should suffice for most cases.
Click the Start Attack button and a new window will pop up. This window is shown below and is similar to the XSW Attacker's Init Attack tab.


Configure the payload as explained in the section above. In addition, a schema analyzer can be selected and checkboxes at the bottom of the window allow the tester to choose a specific encoding. However, for most cases the detected presets should be correct.

Click the Start Attack button and the Intruder will start sending each of the pre-generated vectors to the configured endpoint. Note that this may result in a huge number of outgoing requests. To make it easier to recognize the successful Signature Wrapping attacks, it is recommended to use the Intruder's Grep-Match functionality. As an example, consider adding the replacement values from the Modifications Table as a Grep-Match rule in the Intruder's Options tab. By doing so, a successful attack vector will be marked with a checkmark in the results table, if the response includes any of the configure grep rules.

Credits

EsPReSSO's XSW Attacker is based on the WS-Attacker [4] library by Christian Mainka and the original adoption for EsPReSSO has been implemented by Tim Günther.
Our students Nurullah Erinola, Nils Engelberts and David Herring did a great job improving the execution of XSW and implementing a much better UI.

---

[1] On Breaking SAML - Be Whoever You Want to Be
[2] Your Software at My Service
[3] Se­cu­ri­ty Ana­ly­sis of XAdES Va­li­da­ti­on in the CEF Di­gi­tal Si­gna­tu­re Ser­vices (DSS)
[4] WS-Attacker

Related posts


  1. Pentest Tools Alternative
  2. Hacking Apps
  3. Hacking Tools For Kali Linux
  4. Pentest Tools Tcp Port Scanner
  5. Underground Hacker Sites
  6. Pentest Tools Website Vulnerability
  7. Hack Tools Online
  8. Pentest Tools For Ubuntu
  9. Hacker Tools Github
  10. Hacking Tools And Software
  11. Hacking Tools Github
  12. Hacking App
  13. Wifi Hacker Tools For Windows
  14. Pentest Reporting Tools
  15. Hack Tools For Mac
  16. Nsa Hacker Tools
  17. Best Pentesting Tools 2018
  18. New Hacker Tools
  19. Hacker Tools Hardware
  20. Hacker Tools For Mac
  21. Hacker Tools
  22. Computer Hacker
  23. Hack Tools For Windows
  24. Hacker Tools
  25. Hacker Security Tools
  26. Hack Tools Download
  27. What Is Hacking Tools
  28. Hack Tools Mac
  29. Hack Tools For Mac
  30. Hack Tools For Games
  31. Blackhat Hacker Tools
  32. Kik Hack Tools
  33. Pentest Tools Framework
  34. Hack Tools Pc
  35. Tools For Hacker
  36. Hacking Tools Windows 10
  37. Tools For Hacker
  38. Hack Tools For Ubuntu
  39. Pentest Tools Windows
  40. Hacker Tools Online
  41. Computer Hacker
  42. Hack Tools Online
  43. Pentest Box Tools Download
  44. Hacking Tools
  45. Pentest Tools Linux
  46. Hacking Tools Usb
  47. Hack Tools Mac
  48. Hacker Tools Free
  49. Hack Tools
  50. Hack Tools Download
  51. Hacking Tools
  52. Pentest Tools Free
  53. Hack Tools Download
  54. Wifi Hacker Tools For Windows
  55. Hacker Tools List
  56. Pentest Tools Subdomain
  57. Hacking Tools And Software
  58. Hack App
  59. Hacking Tools Name
  60. Hacker Tools Apk
  61. Hacking Tools For Pc
  62. Hacker Tools For Ios
  63. Blackhat Hacker Tools
  64. Best Hacking Tools 2020
  65. Hacks And Tools
  66. Free Pentest Tools For Windows
  67. Hacker Tools Free Download
  68. Hacking Tools Pc
  69. Physical Pentest Tools
  70. Hack Tool Apk No Root
  71. Best Pentesting Tools 2018
  72. Hack Tools Pc
  73. Physical Pentest Tools
  74. Hak5 Tools
  75. Hacker Tools 2019
  76. Pentest Tools Apk
  77. Blackhat Hacker Tools
  78. Hack Apps
  79. New Hacker Tools
  80. Best Pentesting Tools 2018
  81. Hacking Tools Github
  82. Hack And Tools
  83. Pentest Tools Download
  84. Nsa Hacker Tools
  85. Hack Tools
  86. Pentest Tools Tcp Port Scanner
  87. Hacker Tools Online
  88. Hack Tools For Windows
  89. Nsa Hack Tools Download
  90. Hack Tools Online
  91. Hack Tools Github
  92. Tools Used For Hacking
  93. Hacker Tools For Mac
  94. Hack Apps
  95. Usb Pentest Tools
  96. Hack Tools For Ubuntu
  97. Hack Tools For Ubuntu
  98. Tools Used For Hacking
  99. Hacker Tools For Ios
  100. Hack Tools Pc
  101. Hacker Tools Online
  102. Hack Tool Apk No Root
  103. Hacker Tools Github
  104. Pentest Reporting Tools
  105. Pentest Reporting Tools
  106. Hack Apps
  107. Tools For Hacker
  108. Hack Apps
  109. Hacking Tools Pc
  110. Pentest Tools Download
  111. Hacker Tools Linux
  112. Pentest Tools Kali Linux
  113. Hacker Tools
  114. Pentest Tools Apk
  115. Pentest Tools For Windows
  116. Hack Tools For Mac
  117. What Is Hacking Tools
  118. Hacker Tools 2019
  119. Hacker Tools Windows
  120. Pentest Tools For Android
  121. Top Pentest Tools
  122. Hacker Tools Github
  123. Easy Hack Tools
  124. Pentest Tools Framework
  125. Pentest Tools Framework
  126. Hacker Tools For Windows
  127. Pentest Recon Tools
  128. How To Make Hacking Tools
  129. Hacking Tools For Kali Linux
  130. Hack Tools
  131. Pentest Tools Tcp Port Scanner
  132. Hack Tools Online
  133. Hack Tools For Pc
  134. Growth Hacker Tools
  135. Hack Tools
  136. Pentest Reporting Tools
  137. Hack Tools
  138. Pentest Recon Tools
  139. Pentest Tools Online
  140. Hack Tools For Pc

Tagged as:
About the Author

Write admin description here..

Get Updates

Subscribe to our e-mail newsletter to receive updates.

Share This Post

Related posts

0 comentarios:

What they says

© 2013 ECOLOGÍA. WP Theme-junkie converted by BloggerTheme9
Blogger templates. Proudly Powered by Blogger.
back to top