# Browser & Identity Attacks Matrix for SaaS Security

> Browser & Identity Attacks Matrix documents SaaS, browser, identity, and phishing techniques in an ATT&CK-style reference structure. It is intended for security researchers and defenders, but remains a work in progress rather than an executable testing tool.

**pushsecurity/browser-identity-attacks-matrix** — Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face. #nolockdown

- Repository: https://github.com/pushsecurity/browser-identity-attacks-matrix
- Website: https://pushsecurity.com/blog/saas-attack-techniques/
- Stars: 1,441 · Forks: 108
- Language: Unknown
- License: CC-BY-4.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/pushsecurity-browser-identity-attacks-matrix

## Why Browser & Identity Attacks Matrix exists

The repository addresses a gap between conventional endpoint attack models and the ways SaaS and identity services can be abused. Its stated purpose is to collect attack techniques for defenders to understand the threats they face. The scope covers SaaS applications, browser-based attacks, identity providers, and phishing rather than only malware and endpoint compromise. The README describes users as security researchers, red and blue teams, and penetration testers who want to learn about and share these techniques. That makes the project a reference collection rather than an application that scans a system or executes an assessment. Its value is organizational: it places individual techniques into a matrix inspired by MITRE ATT&CK, while deliberately moving away from ATT&CK's endpoint focus. The project is also called a work in progress. The README asks contributors to add references, examples, and missing techniques through issues or pull requests, so the repository presents itself as incomplete and open to expansion.

## Networkless threats mapped to ATT&CK-style tactics

The matrix organizes techniques under Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, and Exfiltration. The repository labels attacks that do not touch endpoints or customer networks as networkless attacks. This framing is specific to the project. Examples listed under reconnaissance include SAML enumeration, subdomain tenant discovery, slug tenant enumeration, DNS reconnaissance, and username enumeration. Initial Access includes consent phishing, poisoned tenants, SAMLjacking, account ambushing, and credential stuffing. Other entries connect OAuth tokens, API keys, malicious mail rules, and evil twin integrations with several tactic columns, showing that a single technique can affect multiple stages of an attack. The matrix therefore works as an index and classification aid. It can help a defender ask which identity and SaaS behaviors deserve dedicated detection or review. It does not, based on the repository layout and README, provide a runtime model, telemetry schema, detection query, or automated mapping to product features. The matrix is best treated as a map for further investigation, not as an executable control.

## Techniques spanning SaaS, identity, and browsers

The linked technique descriptions show that the repository covers several layers of the browser and identity path. SAML enumeration, SAMLjacking, passwordless logins, and abuse of existing OAuth integrations concern identity and authentication workflows. Consent phishing, account ambushing, credential stuffing, password scraping, and OAuth token enumeration concern access to accounts or sessions. API keys, API secret theft, webhooks, and evil twin integrations concern application integrations and secrets. Shadow workflows, client-side app spoofing, and malicious mail rules describe behavior outside a conventional endpoint-centric model. The README specifically says that the expanded scope includes malicious extensions and phishing. This is an important limitation for readers deciding how much of the catalog applies to their environment. The project is broad by design, so adoption should be based on the technique references that match a specific SaaS or identity architecture. A defender operating a single application may find many entries irrelevant, while a defender covering several tenants and integrations may use the cross-tactic structure to identify interactions between account access, application authorization, and data movement.

## Reading and extending the technique catalog

Each visible matrix entry links to a Markdown file under `techniques/`, such as `techniques/saml_enumeration/description.md` and `techniques/consent_phishing/description.md`. The top-level repository contains the `techniques/` directory alongside `README.md`, `CONTRIBUTORS.md`, `LICENSE`, and `.gitignore`. The README does not provide an installation procedure, command-line interface, service configuration, or packaged library. It also does not document a machine-readable export, so the documented way to use the project is to read the matrix and follow its technique links. Contributors can extend the catalog through an issue or pull request, according to the README. That contribution model is appropriate for a living knowledge base, but it means coverage, terminology, and depth may vary between entries. The project does not claim a release process, and the repository has no GitHub releases. Teams should therefore treat the repository's current files as the source of truth for what is documented, rather than assuming that every tactic cell has complete guidance or that each technique has a stable version.

## Where the matrix stops short

The repository is not an attack tool, scanner, exploitation framework, or defensive control according to its description and README. It does not state that it can test a tenant, enumerate a real service, execute phishing, collect credentials, or produce a detection. It also does not document remediation procedures for individual findings, rollback guidance, environment variables, authentication for access to a hosted service, or a supported integration with a SIEM. Those omissions matter because a tactic matrix identifies threat themes, not proof of compromise. The README explicitly calls the collection a work in progress and acknowledges gaps. A security team that needs executable validation, vendor-specific detections, or remediation runbooks will need separate resources. The CC-BY-4.0 license permits reuse under its terms, but the repository's text does not replace legal review or provide legal advice. The project is most appropriate for research, tabletop threat modeling, control planning, and identifying questions for deeper investigation.

## Browser & Identity Attacks Matrix versus a penetration-testing framework

The clearest alternative is a conventional penetration-testing framework designed to execute and organize tests against a defined target. Browser & Identity Attacks Matrix takes a different approach. It collects descriptions of attack techniques and maps them to SaaS and identity-related tactics, while the repository does not document target configuration, test execution, reporting, or automation. A penetration-testing framework may support repeatable procedures and evidence collection, but those capabilities are not claimed here. Conversely, this matrix can cover concerns that many endpoint-oriented frameworks do not center, including tenant discovery, consent phishing, OAuth integrations, API secrets, malicious mail rules, and application takeover services. The two approaches are complementary rather than interchangeable. The matrix can help define what a specialist assessment should investigate. It cannot establish whether a particular SAML configuration, OAuth grant, browser extension policy, or integration is exposed. The repository also links to background material, including a Push Security blog post and a Microsoft BlueHat presentation, but those links are context rather than an installed test environment or an implementation dependency.

## Maintenance, licensing, and adoption boundaries

The repository is not archived, and its last push was on 2026-04-21. That date indicates recent repository activity, but it does not establish that every technique entry is current or complete. The README describes the project as a work in progress and invites contributions, which creates a documentation maintenance burden for readers who need stable procedures. There are no GitHub releases, so no release cadence or packaged upgrade process is documented. The license is CC-BY-4.0. That matters for teams intending to copy, adapt, or redistribute the material, because attribution and license obligations apply under the license terms. The repository does not state compatibility guarantees for downstream security tooling or a formal review process for contributed techniques. Adoption should therefore be limited to teams comfortable with an evolving reference collection. First verify the specific technique pages you plan to use, confirm that their assumptions match your identity provider and SaaS applications, and inspect the repository's contribution and license files before incorporating the material into internal documentation.

## Conclusion

Adopt this repository as a reference for threat modeling and security research when your scope includes browsers, SaaS applications, identity providers, or phishing. Do not treat the matrix as a complete attack playbook, scanner, or substitute for application-specific validation. Verify first that the referenced techniques match your tenant configuration, integrations, identity flows, and defensive controls.

## FAQ

### What is Browser & Identity Attacks Matrix?

It is a collection of attack techniques for SaaS applications, browsers, identity providers, and phishing. The repository presents it as a resource for security researchers, red and blue teams, and penetration testers.

### Does Browser & Identity Attacks Matrix provide installation instructions?

No. The README does not document installation steps, a command-line interface, or a runnable service. The documented usage model is to read the matrix and follow links to individual technique descriptions under `techniques/`.

### Is Browser & Identity Attacks Matrix an attack tool or penetration-testing framework?

The repository describes it as a collection and classification of attack techniques, not as an executable attack tool. It does not document automated testing, target configuration, or execution procedures.

## Sources

- [Issues](https://github.com/pushsecurity/browser-identity-attacks-matrix/issues)
- [License: CC-BY-4.0](https://github.com/pushsecurity/browser-identity-attacks-matrix/blob/main/LICENSE)
- [Project website](https://pushsecurity.com/blog/saas-attack-techniques/)
- [pushsecurity/browser-identity-attacks-matrix on GitHub](https://github.com/pushsecurity/browser-identity-attacks-matrix)
- [README](https://github.com/pushsecurity/browser-identity-attacks-matrix/blob/main/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/pushsecurity-browser-identity-attacks-matrix