id: gitlab-saml

info:
  name: Gitlab SAML - Detection
  author: rootxharsh,iamnoooob,pdresearch
  severity: info
  description: |
    The presence of SAML-based authentication on GitLab instances. SAML is commonly used for Single Sign-On (SSO) integrations, which allows users to authenticate with GitLab using an external Identity Provider (IdP).
  metadata:
    verified: true
    max-request: 1
    vendor: gitlab
    product: gitlab
    shodan-query:
      - http.title:"gitlab"
      - cpe:"cpe:2.3:a:gitlab:gitlab"
      - http.html:"gitlab enterprise edition"
    fofa-query:
      - body="gitlab enterprise edition"
      - title="gitlab"
    google-query: intitle:"gitlab"
  tags: panel,saml,gitlab,discovery

http:
  - raw:
      - |
        GET /users/auth/saml/metadata HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "EntityDescriptor"
          - "SAML"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/xml"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502201e9f12998f6f5dde270dd172fcf4e50fedaeb1aebff0f82b3cc7fb753d404887022100801ad271e614421a4f8d71cd03c1202c7a68af91284a02856acfaf403254c389:922c64590222798bb761d5b6d8e72950