Vulnerable SAML App
Vulnerable SAML infrastructure: IDP and SP Docker images showcasing exploitable SAML configurations (e.g. privilege escalation by changing group in SAML response). Based on modified OneLogin Python SAML library; includes CVE-2017-11427 test user.
Collections offline
Technology Python PHP Docker SAML
Categories Free-form Single-player
Author yogisec
Stars 
Last contribution Nov 2, 2020 2y +
Notes
docker-compose up; app at http://127.0.0.1:8000. Users: yogi/bear (unprivileged), admin/(typo password in README), brubble/password (CVE), instructor/(see README). Upgrade yogi to admin by changing group in SAML message.