GRUPO 40121

Testing SAML Endpoints For XML Signature Wrapping Vulnerabilities

A lot can go wrong when validating SAML messages. When auditing SAML endpoints, it's important to look out for vulnerabilities in the signature validation logic. XML Signature Wrapping (XSW) against SAML is an attack where manipulated SAML message is submitted in an attempt to make the endpoint validate the signed parts of the message -- which were correctly validated -- while processing a different attacker-generated part of the message as a way to extract the authentication statements. Because the attacker can arbitrarily forge SAML assertions which are accepted as valid by the vulnerable endpoint, the impact can be severe. [1,2,3]

Testing for XSW vulnerabilities in SAML endpoints can be a tedious process, as the auditor needs to not only know the details of the various XSW techniques, but also must handle a multitude of repetitive copy-and-paste tasks and apply the appropriate encoding onto each message. The latest revision of the XSW-Attacker module in our BurpSuite extension EsPReSSo helps to make this testing process easier, and even comes with a semi-automated mode. Read on to learn more about the new release! 

 SAML XSW-Attacker

After a signed SAML message has been intercepted using the Burp Proxy and shown in EsPReSSO, you can open the XSW-Attacker by navigating to the SAML tab and then the Attacker tab.  Select Signature Wrapping from the drop down menu, as shown in the screenshot below:



To simplify its use, the XSW-Attacker performs the attack in a two step process of initialization and execution, as reflected by its two tabs Init Attack and Execute Attack. The interface of the XSW-Attacker is depicted below.
XSW-Attacker overview

The Init Attack tab displays the current SAML message. To execute a signature wrapping attack, a payload needs to be configured in a way that values of the originally signed message are replaced with values of the attacker's choice. To do this, enter the value of a text-node you wish to replace in the Current value text-field. Insert the replacement value in the text-field labeled New value and click the Add button. Multiple values can be provided; however, all of which must be child nodes of the signed element. Valid substitution pairs and the corresponding XPath selectors are displayed in the Modifications Table. To delete an entry from the table, select the entry and press `Del`, or use the right-click menu.

Next, click the Generate vectors button - this will prepare the payloads accordingly and brings the Execute Attack tab to the front of the screen.

At the top of the Execute Attack tab, select one of the pre-generated payloads. The structure of the selected vector is explained in a shorthand syntax in the text area below the selector.
The text-area labeled Attack vector is editable and can be used to manually fine-tune the chosen payload if necessary. The button Pretty print opens up a syntax-highlighted overview of the current vector.
To submit the manipulated SAML response, use Burp's Forward button (or Go, while in the Repeater).

Automating XSW-Attacker with Burp Intruder

Burp's Intruder tool allows the sending of automated requests with varying payloads to a test target and analyzes the responses. EsPReSSO now includes a Payload Generator called XSW Payloads to facilitate when testing the XML processing endpoints for XSW vulnerabilities. The following paragraphs explain how to use the automated XSW attacker with a SAML response.

First, open an intercepted request in Burp's Intruder (e.g., by pressing `Ctrl+i`). For the attack type, select Sniper. Open the Intruder's Positions tab, clear all payload positions but the value of the XML message (the `SAMLResponse` parameter, in our example). Note: the XSW-Attacker can only handle XML messages that contain exactly one XML Signature.
Next, switch to the Payloads tab and for the Payload Type, select Extension-generated. From the newly added Select generator drop-down menu, choose XSW Payloads, as depicted in the screenshot below.



While still in the Payloads tab, disable the URL-encoding checkbox in the Payload Encoding section, since Burp Intruder deals with the encoding automatically and should suffice for most cases.
Click the Start Attack button and a new window will pop up. This window is shown below and is similar to the XSW Attacker's Init Attack tab.


Configure the payload as explained in the section above. In addition, a schema analyzer can be selected and checkboxes at the bottom of the window allow the tester to choose a specific encoding. However, for most cases the detected presets should be correct.

Click the Start Attack button and the Intruder will start sending each of the pre-generated vectors to the configured endpoint. Note that this may result in a huge number of outgoing requests. To make it easier to recognize the successful Signature Wrapping attacks, it is recommended to use the Intruder's Grep-Match functionality. As an example, consider adding the replacement values from the Modifications Table as a Grep-Match rule in the Intruder's Options tab. By doing so, a successful attack vector will be marked with a checkmark in the results table, if the response includes any of the configure grep rules.

Credits

EsPReSSO's XSW Attacker is based on the WS-Attacker [4] library by Christian Mainka and the original adoption for EsPReSSO has been implemented by Tim Günther.
Our students Nurullah Erinola, Nils Engelberts and David Herring did a great job improving the execution of XSW and implementing a much better UI.

---

[1] On Breaking SAML - Be Whoever You Want to Be
[2] Your Software at My Service
[3] Se­cu­ri­ty Ana­ly­sis of XAdES Va­li­da­ti­on in the CEF Di­gi­tal Si­gna­tu­re Ser­vices (DSS)
[4] WS-Attacker

More information


  1. Hacker Security Tools
  2. Hacking Tools Kit
  3. Pentest Tools Find Subdomains
  4. Pentest Tools Apk
  5. Pentest Tools Website Vulnerability
  6. Hacking Tools Windows 10
  7. Hack Rom Tools
  8. Pentest Tools For Android
  9. Pentest Tools Website Vulnerability
  10. Hack App
  11. Hack Tools Pc
  12. Hacking Tools Usb
  13. Hackrf Tools
  14. Hacks And Tools
  15. Hacker Tools Online
  16. Hacking Tools Github
  17. Ethical Hacker Tools
  18. Pentest Tools Tcp Port Scanner
  19. Pentest Tools Website Vulnerability
  20. Hacker Tools For Mac
  21. Pentest Automation Tools
  22. Hacker Hardware Tools
  23. Hacker Tools Github
  24. Kik Hack Tools
  25. Pentest Tools Online
  26. Hacking Tools Name
  27. What Are Hacking Tools
  28. Pentest Reporting Tools
  29. Hackers Toolbox
  30. Pentest Tools Subdomain
  31. Hack Tools Github
  32. How To Hack
  33. Hacking Tools Pc
  34. Termux Hacking Tools 2019
  35. Pentest Tools Nmap
  36. Hacking Tools Windows
  37. Hacker Tools Hardware
  38. Top Pentest Tools
  39. Pentest Tools Subdomain
  40. Pentest Tools Free
  41. Nsa Hacker Tools
  42. Pentest Tools For Mac
  43. World No 1 Hacker Software
  44. Hacking App
  45. Growth Hacker Tools
  46. Pentest Box Tools Download
  47. Pentest Tools Android
  48. Hacking Tools Windows 10
  49. World No 1 Hacker Software
  50. Hacker Tool Kit
  51. Hacking Tools For Windows Free Download
  52. Growth Hacker Tools
  53. Hacker Tools For Ios
  54. Pentest Tools Website
  55. Hacker
  56. Pentest Tools Tcp Port Scanner
  57. Hacker Tools
  58. Black Hat Hacker Tools
  59. Growth Hacker Tools
  60. Hacker Tools For Mac
  61. Wifi Hacker Tools For Windows
  62. Growth Hacker Tools
  63. Nsa Hack Tools
  64. Pentest Tools Website
  65. Hack Tools
  66. Hacker
  67. Pentest Tools
  68. Install Pentest Tools Ubuntu
  69. Hack Tools For Pc
  70. Hacking Tools For Kali Linux
  71. Hacking Tools Free Download
  72. Hacking Tools Software
  73. Nsa Hack Tools
  74. Hacking Tools For Windows 7
  75. Hacker Tools For Mac
  76. Pentest Tools For Android
  77. Hack Tools
  78. Hacker Search Tools
  79. Hacker Tools Free Download
  80. Computer Hacker
  81. Hacker Tools For Pc
  82. Pentest Tools Android
  83. How To Hack
  84. Hacker Tools For Windows
  85. How To Hack
  86. Hack Tool Apk No Root
  87. How To Make Hacking Tools
  88. Hack Tools For Mac
  89. Underground Hacker Sites
  90. Hacking Tools Software
  91. Hacking Apps
  92. Hacking Tools And Software
  93. Hacking Tools Online
  94. Pentest Tools Android
  95. Pentest Tools Apk
  96. Pentest Tools Android
  97. Hacker Tools Linux
  98. Pentest Tools List
  99. Pentest Tools Review
  100. Pentest Tools Online
  101. Hacker Tools For Mac
  102. World No 1 Hacker Software
  103. Beginner Hacker Tools
  104. How To Hack
  105. Hack Apps
  106. Hack Tools For Mac
  107. Pentest Tools For Ubuntu
  108. Pentest Tools Alternative
  109. Kik Hack Tools
  110. Hack Tools Online
  111. Pentest Tools
  112. Underground Hacker Sites
  113. Hacking Tools For Pc
  114. Hacking Tools Download
  115. Hacker Techniques Tools And Incident Handling
  116. Hack Website Online Tool
  117. Hacking Tools 2019
  118. Hacker Tools For Mac
  119. Blackhat Hacker Tools
  120. Hacker Tools For Windows
  121. Best Hacking Tools 2019
  122. Pentest Tools Windows
  123. Hacker Tools 2020
  124. Hacker Tools Mac
  125. Android Hack Tools Github
  126. Hack Tools For Pc
  127. Pentest Tools Port Scanner
  128. Wifi Hacker Tools For Windows
  129. Bluetooth Hacking Tools Kali
  130. What Are Hacking Tools
  131. Growth Hacker Tools
  132. Hacker Hardware Tools
  133. How To Install Pentest Tools In Ubuntu
  134. Hak5 Tools
  135. Pentest Tools For Ubuntu
  136. What Are Hacking Tools
  137. Hacking Tools Mac
  138. Hacker Security Tools
  139. Game Hacking
  140. Hacking Tools Pc
  141. Hack Tools For Ubuntu
  142. Pentest Reporting Tools
  143. What Are Hacking Tools
  144. Hack Tools Mac
  145. Hacking Apps
  146. Hacker Tools 2019
  147. Termux Hacking Tools 2019
  148. Hacking Tools Free Download

No hay comentarios:

Publicar un comentario

Nota: solo los miembros de este blog pueden publicar comentarios.