Main Page

Welcome to SSO-Attacks

SSO-Attacks.org was created by the Chair for Network and Data Security at Ruhr University Bochum, Germany [1]. Re­se­arch and de­ve­lop­ment at the Chair for Net­work and Data Se­cu­ri­ty con­cen­tra­tes on cryp­to­gra­phic pro­to­cols, In­ter­net se­cu­ri­ty and XML se­cu­ri­ty.

SSO-Attacks.org aims at delivering the most comprehensive enumeration of all known single sign-on (SSO) attacks. All attacks are categorised and structured in a stringent fashion. Depending on your viewpoint, you can choose to have attacks listed by one of the following categories:

• Attack Categorisation by attacker model
  
• Attack Categorisation by attack on IdP/SP
  
• Attack Categorisation by violated security objective
  
• Attack Categorisation by attacked Single Sign-On component
  
• Attack Categorisation by attack spreading
  
• Attack Categorisation by attack on SAML
  

Alternatively, you can browse through the entire list of attacks (sorted by violated security objective):

Attacks primarily violating the security objective "Access Control"

• Certificate_Faking
• Certificate Injection
• Replay_Attack
• Signature_Exclusion_Attack
• XML_Signature_Wrapping

Attacks primarily violating the security objective "Availability"

• Token_Recipient_Confusion

Attacks primarily violating the security objective "Confidentiality"

• Token_Recipient_Confusion
• XML_External_Entity_Attack
• XSLT_Attack

Attacks primarily violating the security objective "Integrity"

• Token_Recipient_Confusion

If you have any questions or comments feel free to contact us! [2]