The worst of all deceptions is self-deception
Goal: To gather information about attackers attempting to exploit SAML vulnerabilities and detect their presence.
Approach: Monitoring access to the deceptive SAML IdP and analyzing attacker behavior.
Attackers who attempt to use the fake SAML IdP for authentication or authorization will be misled, and their actions will be logged.
Goal: Redirect attackers attempting to authenticate to a deceptive environment.
Approach: Manipulating IdP responses to redirect authentication flows.
When an attacker attempts to authenticate through an IdP (e.g., OAuth, SAML), manipulate the response to redirect them to a fake login portal or a controlled environment.