1. Support Center
  2. BApp Store
  3. SAMLReQuest
Professional Community


This extension enables security testers to view, decode, and modify SAML Authentication requests and test IdP's response to their manipulations.

Security Assertion Markup Language (SAML) is used in many single sign-on (SSO) implementations, which authenticate the user once to access several Service Providers (SP). When a user tries to access a SP, it redirects the user to an Identification Provider (IdP) and adds "SAML authentication request" to the redirection request, to which the user is authenticated according.

The extension supports the following features:

  • Decodes SAML authentication requests, whether compressed in the URL (HTTP Redirection Binding) or not compressed in POST body (HTTP POST Binding).
  • Displays the decoded SAML authentication request in Proxy Intercept, Proxy History and Repeater tabs.
Author Ahmad Abolhadid
Version 2.1
Last updated 06 February 2017

You can install BApps directly within Burp, via the BApp Store feature in the Burp Extender tool. You can also download them from here, for offline installation into Burp.

You can view the source code for this BApp by visiting our GitHub page.
Follow @BApp_Store on Twitter to receive notifications of all BApp releases and updates.
Download BApp

Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.

Go back to BappStore