Hi, I'm epi.
These are my notes
About
My name is epi. This site is a long-overdue braindump so I can quickly reference things I often have to look up again or dig through code/notes etc to find. If any of these posts help you at all, that’s great! Please feel free to use/share anything you come across here.
Projects
Latest Post
Apr 24, 2019
How to Hunt Bugs in SAML; a Methodology - Part III
These posts are meant to provide a background and testing methodology. However, a methodology should not be confused with a strict checklist. We’ve discussed a lot of different SAML vulnerabilities and ways to exploit them, but bug discovery can often require creativity and applying different variations on existing techniques.
A great example is Owning SAML. In the post, the author, Rick Osgood, found an open redirect vulnerability in the RelayState parameter passed alongside the normal SAML Response.
Read more
Contact
If you have anything you’d like to ask or discuss, don’t hesitate to get in touch.
Twitter DMs are always open.
My current local time is .