Skip to content

maSSO - a Malicious Auth SSO Utility#

hack.lu 2026 digest Program Core pick 20–23 October 2026

Abstract

francesco lacerenza, Mohamed Ouad (Doyensec)

  • Why: SSO/OIDC/SAML testing is exactly your identity-testing pain point; this is a purpose-built attacker-side IdP rather than a lab shack.
  • What: An open-source (Doyensec, on GitHub) "weaponized" Identity Provider implementing OIDC, SAML 2.0, and SCIM, with the ability to intercept, mock, and re-sign assertions/tokens. Lightning talk; they claim time-to-test is short enough to reproduce famous SSO CVEs live in 5 minutes, with an AWS Cognito target demoed on stage. Not recorded.
  • How: Stand up the malicious IdP, point the target service provider's federation config at it, then manipulate tokens, claims, signatures, and SCIM provisioning traffic to probe how the SP validates them.
  • Where applicable: Any environment testing SSO integrations — cloud IdPs (Cognito, Entra, Okta-style setups), SaaS SPs, SCIM provisioning. It's a testing tool, not a vulnerability disclosure. (from abstract only)