Resources

IdP Pre-login CSRF 

Demonstrative videos about the forging of the URL

• Facebook

• Linkedin

• Google (to maintain anonymity, we cannot post the video.)

SSO Account Hijack Attack

Videos about the automated testing of the SPs

• Workable

• Naver

• Goodreads

Test definitions

Here you can find the list of test definitions to be inserted in the tool based on the IdP

• Facebook test

• Google test

• Linkedin test

Session tracks of the SPs used to test them:

• Workable session track

• Naver session track

• Goodreads session track

Testing tool

The testing tool used during our tests can be found here.