Malicious SAML IdP

Cross-Domain Account Takeover POC


Status: Running

Target victim: victim.native@gmail.com

Metadata URL: /metadata


This IdP will forge a SAML assertion for victim.native@gmail.com regardless of which user initiates the login flow.

To test: configure a routing rule in Okta for any domain, then attempt to log in with any email matching that rule.