Rogue SAML IdP
Craft SAML Response
ACS URL (POST target):
SP Entity ID (Audience):
InResponseTo (Request ID):
RelayState:
NameID (victim email):
NameID Format:
unspecified
emailAddress
persistent
transient
NameID Quirk:
None (plain)
Comment append: email<!---->
Comment prepend: <!---->email
Comment split user: us<!---->er@domain
Comment split domain: user@do<!---->main
Comment hide suffix: email<!---->.evil.com
Null byte append: email
Null byte + evil: victim attacker@evil.com
Leading space
Trailing space
Trailing newline
Cyrillic а (U+0430) for first 'a'
Cyrillic е (U+0435) for first 'e'
Cyrillic о (U+043E) for first 'o'
Double URL-encode @: %2540
Sign what:
Assertion only
Both Response + Assertion
Response only
None (unsigned)
Session Duration (minutes):
Extra Attributes (one per line, name=value):
Generate & Send SAML Response