Now it is very easy to modify the SAMLRequest. SAML Raider is now able to properly decode a SAMLRequest and display it in the SAML Raider tab: So, it’s quite clear, that this is not so practical for quick editing and testing. If the login was successful, the SAMLResponse is sent back to the client, which is then forwarded to the Service Provider.Ī SAMLRequest is sent via POST to the Identity Provider and looks like this: Usually, the SAMLRequest is sent to the Identity Provider, which will respond with a login form to ask for the credentials.

Because this would be a nice feature, we implemented it in version 1.2.0.Ī SAMLRequest is the SAML message, which is sent from the user (browser) to the Identity Provider, to “ask” for an assertion. We also got asked if this feature is supported in SAML Raider, which was not the case. There are several Burp Extensions like SAML ReQuest, SAML Editor or SAML Encoder which allows you to edit SAMLRequests. It will also be in the official Burp Suite BApp store shortly. The current version is 1.2.1, which is available here on GitHub. In version 1.2.0, we introduced the new ability to intercept and edit SAMLRequest Messages.

We did some bugfixing and added new features to SAML Raider in the past year. More information is available in our first blog post about SAML Raider here: SAML Burp Extension . With SAML Raider, an authentication bypass vulnerability in a Service Provider was found. This Burp extension automates most of the steps, which are necessary to test a SAML single sign-on process and perform according attacks. About a year ago, the Burp extension SAML Raider was released as a result of a bachelor thesis in collaboration with Compass Security.

Burp suite pro github