SSO Security Issues

Single sign-on (SSO) is a feature that allows users to access multiple services belonging to the same organization without logging in multiple times. Once you've logged into a website that uses SSO, you won't have to enter your credentials again when accessing another service or resource belonging to the same company.

Hunt for SSO vulnerabilities

1. If the target application is using single sign-on, determine the SSO mechanism in use.
2. If the application is using shared session cookies, try to steal session cookies by using subdomain takeovers.
3. If the application is uses a SAML-based SSO scheme, test whether the server is verifying SAML signatures properly.
4. If the pplication uses OAuth, try to steal OAuth tokens by using open redirects