Lab 19 — SecureAuth SSO - SAML Parser Differential

hackadvisor

Task: Ruby/Sinatra SSO app uses REXML for SAML signature verification and Nokogiri for data extraction — classic parser differential setup. Solution: Used xml:xmlns namespace confusion (PortSwigger 'The Fragile Lock') to wrap ds:Signature in a wrapper element that makes it invisible to REXML's XPath queries while Nokogiri still parses the assertion normally, bypassing signature verification and gaining admin access.