A lot can go wrong when validating SAML messages. When auditing SAML endpoints, it's important to look out for vulnerabilities in the signature validation logic. XML Signature Wrapping (XSW) against SAML is an attack where manipulated SAML message is submitted in an attempt to make the endpoint validate the signed parts of the message -- which were correctly validated -- while processing a different attacker-generated part of the message as a way to extract the authentication statements. Because the attacker can arbitrarily forge SAML assertions which are accepted as valid by the vulnerable endpoint, the impact can be severe. [1,2,3]
Testing for XSW vulnerabilities in SAML endpoints can be a tedious process, as the auditor needs to not only know the details of the various XSW techniques, but also must handle a multitude of repetitive copy-and-paste tasks and apply the appropriate encoding onto each message. The latest revision of the XSW-Attacker module in our BurpSuite extension EsPReSSo helps to make this testing process easier, and even comes with a semi-automated mode. Read on to learn more about the new release!
To simplify its use, the XSW-Attacker performs the attack in a two step process of initialization and execution, as reflected by its two tabs Init Attack and Execute Attack. The interface of the XSW-Attacker is depicted below.
The Init Attack tab displays the current SAML message. To execute a signature wrapping attack, a payload needs to be configured in a way that values of the originally signed message are replaced with values of the attacker's choice. To do this, enter the value of a text-node you wish to replace in the Current value text-field. Insert the replacement value in the text-field labeled New value and click the Add button. Multiple values can be provided; however, all of which must be child nodes of the signed element. Valid substitution pairs and the corresponding XPath selectors are displayed in the Modifications Table. To delete an entry from the table, select the entry and press `Del`, or use the right-click menu.
Next, click the Generate vectors button - this will prepare the payloads accordingly and brings the Execute Attack tab to the front of the screen.
At the top of the Execute Attack tab, select one of the pre-generated payloads. The structure of the selected vector is explained in a shorthand syntax in the text area below the selector.
The text-area labeled Attack vector is editable and can be used to manually fine-tune the chosen payload if necessary. The button Pretty print opens up a syntax-highlighted overview of the current vector.
To submit the manipulated SAML response, use Burp's Forward button (or Go, while in the Repeater).
First, open an intercepted request in Burp's Intruder (e.g., by pressing `Ctrl+i`). For the attack type, select Sniper. Open the Intruder's Positions tab, clear all payload positions but the value of the XML message (the `SAMLResponse` parameter, in our example). Note: the XSW-Attacker can only handle XML messages that contain exactly one XML Signature.
Next, switch to the Payloads tab and for the Payload Type, select Extension-generated. From the newly added Select generator drop-down menu, choose XSW Payloads, as depicted in the screenshot below.
While still in the Payloads tab, disable the URL-encoding checkbox in the Payload Encoding section, since Burp Intruder deals with the encoding automatically and should suffice for most cases.
Click the Start Attack button and a new window will pop up. This window is shown below and is similar to the XSW Attacker's Init Attack tab.
Configure the payload as explained in the section above. In addition, a schema analyzer can be selected and checkboxes at the bottom of the window allow the tester to choose a specific encoding. However, for most cases the detected presets should be correct.
Click the Start Attack button and the Intruder will start sending each of the pre-generated vectors to the configured endpoint. Note that this may result in a huge number of outgoing requests. To make it easier to recognize the successful Signature Wrapping attacks, it is recommended to use the Intruder's Grep-Match functionality. As an example, consider adding the replacement values from the Modifications Table as a Grep-Match rule in the Intruder's Options tab. By doing so, a successful attack vector will be marked with a checkmark in the results table, if the response includes any of the configure grep rules.
Our students Nurullah Erinola, Nils Engelberts and David Herring did a great job improving the execution of XSW and implementing a much better UI.
---
[1] On Breaking SAML - Be Whoever You Want to Be
[2] Your Software at My Service
[3] Security Analysis of XAdES Validation in the CEF Digital Signature Services (DSS)
[4] WS-Attacker
Testing for XSW vulnerabilities in SAML endpoints can be a tedious process, as the auditor needs to not only know the details of the various XSW techniques, but also must handle a multitude of repetitive copy-and-paste tasks and apply the appropriate encoding onto each message. The latest revision of the XSW-Attacker module in our BurpSuite extension EsPReSSo helps to make this testing process easier, and even comes with a semi-automated mode. Read on to learn more about the new release!
SAML XSW-Attacker
After a signed SAML message has been intercepted using the Burp Proxy and shown in EsPReSSO, you can open the XSW-Attacker by navigating to the SAML tab and then the Attacker tab. Select Signature Wrapping from the drop down menu, as shown in the screenshot below:To simplify its use, the XSW-Attacker performs the attack in a two step process of initialization and execution, as reflected by its two tabs Init Attack and Execute Attack. The interface of the XSW-Attacker is depicted below.
XSW-Attacker overview |
The Init Attack tab displays the current SAML message. To execute a signature wrapping attack, a payload needs to be configured in a way that values of the originally signed message are replaced with values of the attacker's choice. To do this, enter the value of a text-node you wish to replace in the Current value text-field. Insert the replacement value in the text-field labeled New value and click the Add button. Multiple values can be provided; however, all of which must be child nodes of the signed element. Valid substitution pairs and the corresponding XPath selectors are displayed in the Modifications Table. To delete an entry from the table, select the entry and press `Del`, or use the right-click menu.
Next, click the Generate vectors button - this will prepare the payloads accordingly and brings the Execute Attack tab to the front of the screen.
At the top of the Execute Attack tab, select one of the pre-generated payloads. The structure of the selected vector is explained in a shorthand syntax in the text area below the selector.
The text-area labeled Attack vector is editable and can be used to manually fine-tune the chosen payload if necessary. The button Pretty print opens up a syntax-highlighted overview of the current vector.
To submit the manipulated SAML response, use Burp's Forward button (or Go, while in the Repeater).
Automating XSW-Attacker with Burp Intruder
Burp's Intruder tool allows the sending of automated requests with varying payloads to a test target and analyzes the responses. EsPReSSO now includes a Payload Generator called XSW Payloads to facilitate when testing the XML processing endpoints for XSW vulnerabilities. The following paragraphs explain how to use the automated XSW attacker with a SAML response.First, open an intercepted request in Burp's Intruder (e.g., by pressing `Ctrl+i`). For the attack type, select Sniper. Open the Intruder's Positions tab, clear all payload positions but the value of the XML message (the `SAMLResponse` parameter, in our example). Note: the XSW-Attacker can only handle XML messages that contain exactly one XML Signature.
Next, switch to the Payloads tab and for the Payload Type, select Extension-generated. From the newly added Select generator drop-down menu, choose XSW Payloads, as depicted in the screenshot below.
While still in the Payloads tab, disable the URL-encoding checkbox in the Payload Encoding section, since Burp Intruder deals with the encoding automatically and should suffice for most cases.
Click the Start Attack button and a new window will pop up. This window is shown below and is similar to the XSW Attacker's Init Attack tab.
Configure the payload as explained in the section above. In addition, a schema analyzer can be selected and checkboxes at the bottom of the window allow the tester to choose a specific encoding. However, for most cases the detected presets should be correct.
Click the Start Attack button and the Intruder will start sending each of the pre-generated vectors to the configured endpoint. Note that this may result in a huge number of outgoing requests. To make it easier to recognize the successful Signature Wrapping attacks, it is recommended to use the Intruder's Grep-Match functionality. As an example, consider adding the replacement values from the Modifications Table as a Grep-Match rule in the Intruder's Options tab. By doing so, a successful attack vector will be marked with a checkmark in the results table, if the response includes any of the configure grep rules.
Credits
EsPReSSO's XSW Attacker is based on the WS-Attacker [4] library by Christian Mainka and the original adoption for EsPReSSO has been implemented by Tim Günther.Our students Nurullah Erinola, Nils Engelberts and David Herring did a great job improving the execution of XSW and implementing a much better UI.
---
[1] On Breaking SAML - Be Whoever You Want to Be
[2] Your Software at My Service
[3] Security Analysis of XAdES Validation in the CEF Digital Signature Services (DSS)
[4] WS-Attacker
Continue reading
- Hack Tools For Pc
- Pentest Tools Windows
- Hacker Tools 2020
- Hack Tools Github
- Free Pentest Tools For Windows
- Hacking Tools Windows
- Hacking Tools Free Download
- Underground Hacker Sites
- Nsa Hacker Tools
- Hack Tools Download
- World No 1 Hacker Software
- Hacking Tools Free Download
- Hacking Tools Pc
- Hack Tool Apk
- Hacking Tools For Windows
- Hacks And Tools
- Tools 4 Hack
- Hacker Techniques Tools And Incident Handling
- Hacker Tools Mac
- Pentest Tools For Android
- Pentest Reporting Tools
- Hacker
- Hacker Tools Hardware
- Tools Used For Hacking
- Hacking Tools Online
- Hacker Tools 2019
- Beginner Hacker Tools
- Pentest Tools Website
- Growth Hacker Tools
- Hacking Tools Windows 10
- Hacking Tools And Software
- Pentest Tools Website Vulnerability
- Game Hacking
- Pentest Tools Website Vulnerability
- Hacker Hardware Tools
- New Hacker Tools
- Hacker Security Tools
- Hack Tools
- Hack Tools For Pc
- Hacker Tools Mac
- Hacking App
- Pentest Tools Website Vulnerability
- Physical Pentest Tools
- Hacker Tools Mac
- Beginner Hacker Tools
- Pentest Reporting Tools
- Hack Apps
- Best Hacking Tools 2019
- Nsa Hacker Tools
- Pentest Tools Alternative
- Hack Tools For Mac
- Hack And Tools
- Beginner Hacker Tools
- Top Pentest Tools
- Hacking Tools Download
- Hacking Tools For Windows 7
- Hacking Tools For Windows Free Download
- What Are Hacking Tools
- Pentest Tools Download
- Pentest Tools Download
- Hacker Hardware Tools
- Hacker Tools Linux
- Hack Tools Mac
- Hack Rom Tools
- Hack Tools Mac
- Best Hacking Tools 2019
- Android Hack Tools Github
- Hacking Tools 2020
- Hacker Tools Mac
- Hacker Tools Windows
- Hacking Tools For Games
- Hack Tools Download
- Easy Hack Tools
- Hacking Tools 2019
- Computer Hacker
- Hack Tools For Mac
- Hack Tools For Windows
- Hacking Tools For Beginners
- Hacking Tools Windows
- Nsa Hack Tools
- Nsa Hack Tools
- Nsa Hack Tools Download
- Termux Hacking Tools 2019
- Hacking Tools Kit
- Hacker Tools For Pc
- Beginner Hacker Tools
- Usb Pentest Tools
- Hacking Tools Kit
- Hacker Tools 2019
- Hack App
- Pentest Tools For Windows
- Hacking Apps
- Hacking Apps
- Hacker Tools
- Hack Tools Pc
- Ethical Hacker Tools
- Pentest Tools Kali Linux
- Hacker Tools Hardware
- Hacking Tools Download
- Wifi Hacker Tools For Windows
- Hacker Tools Online
- Hack Tools For Windows
- Hacker Tools Mac
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Url Fuzzer
- Hacking Tools For Windows 7
- Pentest Reporting Tools
- Top Pentest Tools
- Hak5 Tools
- Pentest Tools Framework
- Tools Used For Hacking
- Hackers Toolbox
- Android Hack Tools Github
- Hacks And Tools
- Usb Pentest Tools
- Hack Tools
- Hacker Tools Hardware
- Hack Tools Github
- Hacker Tools Windows
- Pentest Tools Free
- Hacker Tools For Ios
- Hack Tools Github
- Github Hacking Tools
- Nsa Hacker Tools
- Github Hacking Tools
- Hacking Tools Github
- Hacking Tools 2020
- Hak5 Tools
- How To Make Hacking Tools
- Top Pentest Tools
- Hacking Tools Download
- Bluetooth Hacking Tools Kali
- Hacking Tools Software
- Pentest Tools Kali Linux
- Hacker Tools For Pc
- Hacker Tools Apk Download
- Hacker Tools Linux
- Hacker Tools For Mac
- Tools Used For Hacking
- Hack Tools Mac
- Top Pentest Tools
- Hacker Tools For Pc
- Hack Tools Mac
- Hacking Tools Hardware
- Ethical Hacker Tools
- Android Hack Tools Github
- Best Hacking Tools 2019
- Hacker Tools
- Hacking Tools Windows 10
- Top Pentest Tools
- What Is Hacking Tools
- Hack Rom Tools
- Pentest Tools Kali Linux
- Hacker Tools Apk
- Hacking Tools
- Termux Hacking Tools 2019
- Hacking Tools For Kali Linux
- Hackrf Tools
- Hacking Tools For Windows
- Hack Tools For Games
- Hacking Tools Hardware
- Hack Tools For Pc
- Pentest Tools
- New Hack Tools
- Hacking Tools Windows 10
- How To Make Hacking Tools
- Black Hat Hacker Tools
- Hacker Tools Free Download
- Hack Tools Pc
- New Hack Tools
- New Hack Tools
No comments:
Post a Comment