Documentation
¶
Index ¶
- Constants
- Variables
- func DeflateCompress(data []byte) ([]byte, error)
- func DeflateDecompress(data []byte) ([]byte, error)
- func EncodeSAML(xmlContent string, original *DecodedSAML) string
- func InjectDOCTYPE(doc *XMLDocument, decoded *DecodedSAML, systemURL string) (string, error)
- func InjectENTITY(doc *XMLDocument, decoded *DecodedSAML, systemURL string) (string, error)
- type DecodedSAML
- type Module
- type XMLDocument
Constants ¶
const ( ModuleID = "xml-saml-security" ModuleName = "XML SAML Security" ModuleShort = "SAML XML security checks (XXE + signature verification)" )
Variables ¶
Functions ¶
func DeflateCompress ¶
DeflateCompress compresses data using DEFLATE (raw, no header).
func DeflateDecompress ¶
DeflateDecompress decompresses DEFLATE data (raw, no header).
func EncodeSAML ¶
func EncodeSAML(xmlContent string, original *DecodedSAML) string
EncodeSAML encodes XML back to SAML format using original encoding.
func InjectDOCTYPE ¶
func InjectDOCTYPE(doc *XMLDocument, decoded *DecodedSAML, systemURL string) (string, error)
InjectDOCTYPE creates a payload with an external-DTD DOCTYPE pointing at the supplied out-of-band (OAST) callback URL. If the target's XML parser loads the external DTD subset, it fetches systemURL and the OAST server records an interaction — the only signal that confirms the parser processes external DTDs.
func InjectENTITY ¶
func InjectENTITY(doc *XMLDocument, decoded *DecodedSAML, systemURL string) (string, error)
InjectENTITY creates a payload that declares an external general entity pointing at the supplied OAST callback URL and references it in the document body (in place of the original ID value). If the parser resolves and expands the entity, it fetches systemURL and the OAST server records an interaction — out-of-band proof of XXE, replacing the previous response-shape heuristic.
Types ¶
type DecodedSAML ¶
DecodedSAML holds the decoded SAML data and encoding flags.
func DecodeSAML ¶
func DecodeSAML(input string) (*DecodedSAML, error)
DecodeSAML decodes a SAML parameter value. Flow: URL decode -> Base64 decode -> DEFLATE decompress -> XML
type Module ¶
type Module struct {
modkit.BaseActiveModule
// contains filtered or unexported fields
}
Module implements XML SAML security scanning.
func (*Module) ScanPerInsertionPoint ¶
func (m *Module) ScanPerInsertionPoint( ctx *httpmsg.HttpRequestResponse, ip httpmsg.InsertionPoint, httpClient *http.Requester, scanCtx *modkit.ScanContext, ) ([]*output.ResultEvent, error)
ScanPerInsertionPoint plants out-of-band (OAST) XXE probes into SAML XML.
Confirmation is purely out-of-band: each probe declares an external DTD / external entity pointing at a unique OAST callback URL, and a finding is emitted ASYNCHRONOUSLY by the OAST poller only if the target's XML parser actually resolves it and calls back. There is no synchronous, response-shape based verdict — that heuristic produced false positives (it could not tell a parsed DTD from a silently stripped one), so the module no-ops without OAST.
type XMLDocument ¶
type XMLDocument struct {
Content string
HasDoctype bool
IDAttrVal string // Value of ID attribute if found
}
XMLDocument represents a parsed XML document.
func ParseXML ¶
func ParseXML(content string) (*XMLDocument, error)
ParseXML parses XML content and extracts metadata.
Source Files