Pentest SAML IdP Testing

AuthnRequest from: urn:amazon:cognito:sp:eu-central-1_RxQJPTi94
ACS URL: https://duco-pentest2.auth.eu-central-1.amazoncognito.com/saml2/idpresponse
Request ID: _test_d2a438bb592b43b28ed1ef2120ed3ae6

Identity / Persona

Signature & Timing

Signing mode

Note: XSW attacks (below) override this field.

Assertion timing

XML-Level Attacks

XML attack

XSW: verifier sees alice/user; parser may see persona identity.

AttributeNameFormat

Tests whether SP deduplicates or selects by NameFormat.

SubjectConfirmation & AuthnContext

SubjectConfirmation

AuthnContext class override

e.g. urn:oasis:names:tc:SAML:2.0:ac:classes:X509 to claim cert-based auth

Field Overrides (leave blank = use persona value)

NameID override

Audience override

Recipient override

InResponseTo override

Extra Attributes (JSON, merged on top of persona)

Extra attributes

Values must be arrays. Duplicate keys override the persona's value.