exploiting-saml-authentication-flaws

Capture a valid SAMLResponse, then systematically test signature removal, XML Signature Wrapping (XSW1-8), NameID comment injection, and assertion replay. SAML Raider in Burp Suite automates signature removal, wrapping templates, and re-signing with custom certificates.

XML Signature Wrapping keeps a validly signed element so verification passes while injecting a second forged assertion that the application actually processes. There are eight XSW permutations differing in parent nodes, ID handling, and element ordering.

Inserting an XML comment inside the NameID element keeps the signature valid because canonicalization ignores comments, but a vulnerable XML reader may return only the text before the comment. For example, [email protected]<!---->.evil.example can truncate to the admin identity.

Burp Suite Professional with the SAML Raider extension is the primary toolkit for editing, wrapping, and re-signing SAML messages. xmllint, Python with zlib and base64, SAML-tracer, and xmlsec1 support decoding, encoding, and signature inspection.

Rejections often come from incorrect re-encoding rather than fixed vulnerabilities. Redirect-binding messages require raw-deflate, base64, and URL-encoding in the correct order, so verify your tampered message round-trips before concluding the flaw is fixed.

Only test with written authorization covering authentication bypass and IdP/SP testing. Without an explicit penetration testing agreement or bug bounty scope, forging assertions and impersonating users is unauthorized access.