SAML2 has been the backbone of enterprise single sign-on for over 20 years. Behind its familiar facade lies a chaotic mix of legacy specifications, fragile XML processing, and false assurances of security. Despite endless patches and best practices, the protocol continues to collapse under the weight of its own complexity.
In this talk, I will show you how to bypass authentication using subtle flaws in XML handling. I will introduce several previously unpublished techniques that enable the crafting of reliable, stealthy exploits against SAML implementations that appear secure on the surface.
I will also release an open-source toolkit designed to identify and exploit these vulnerabilities in real-world SAML deployments.
It is time to stop patching the unpatchable and start questioning the protocol itself.
By: Zak Fedotkin | Researcher, PortSwigger
https://ift.tt/D4o6VIw
source https://www.youtube.com/watch?v=o5KpYzbQYG0
-
Unmasking State-Sponsored Mobile Surveillance Malware from Russia, China, and North Korea – Threat Actors, Tactics, and Defense Strategies S...
-
Germany recalled its ambassador to Russia for a week of consultations in Berlin following an alleged hacker attack on Chancellor Olaf Scho...
No comments:
Post a Comment