Lab 305 — TeamSync — SAML Signature Bypass to Admin Takeover

hackadvisor

Task: TeamSync exposes a SAML SSO flow where configuration can be enumerated through the web app and API. Solution: discover that signature validation is optional, forge an unsigned SAMLResponse with admin claims, post it to the ACS endpoint, and use the issued session to access /admin and recover the real flag.

signature_bypass authentication_bypass express privilege_escalation admin_takeover xml saml sso

forged_assertion_submissionrole_claim_tamperingsaml_signature_validation_bypassunsigned_samlresponse_forgery

$ ls tags/ techniques/

signature_bypass authentication_bypass express privilege_escalation admin_takeover xml saml sso

forged_assertion_submissionrole_claim_tamperingsaml_signature_validation_bypassunsigned_samlresponse_forgery

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[web][Pro]Lab 285 — FlowBoard — SAML SSO Dual-Parser Authentication Bypass— hackadvisor
[web][Pro]Lab 302 — WorkPulse — Stored XSS to Account Takeover via SSO Unlink Chain— hackadvisor
[web][Pro]Lab 376 — CodeNexus — SAML Signature Wrapping— hackadvisor
[web][Pro]Lab 274 — CloudPulse — SAML XML Signature Wrapping via Dual-Parser Inconsistency— hackadvisor
[web][Pro]Lab 19 — SecureAuth SSO - SAML Parser Differential— hackadvisor