Attacking the Authentication Layer – a SAML Use Case

“‘They say only: The Doors of Durin, Lord of Moria. Speak, friend, and enter. [...]’ ‘What does it mean by speak, friend, and enter?’ asked Merry.

‘That is plain enough,’ said Gimli. ‘If you are a friend, speak the password, and the doors will open, and you can enter.’

‘Yes,’ said Gandalf, ‘these doors are probably governed by words.”

J. R. R. Tolkien [1]

Welcome to the third chapter, where we analyze our vulnerable applications with a Capture the Flag (CTF) exercise on Security Assertion Markup Language (SAML).

As Gimli tells Gandalf, you only need to know the password to access it (and we can add the username or other factors). Applications typically solve this problem by requiring the user to identify themself with something that only they know (e.g., a password), something they have (e.g., an OTP), something that...