BApp details: SAMLReQuest
This extension enables security testers to view, decode, and modify SAML Authentication requests and test IdP's response to their manipulations.
Security Assertion Markup Language (SAML) is used in many single sign-on (SSO) implementations, which authenticate the user once to access several Service Providers (SP). When a user tries to access a SP, it redirects the user to an Identification Provider (IdP) and adds "SAML authentication request" to the redirection request, to which the user is authenticated according.
The extension supports the following features:
- Decodes SAML authentication requests, whether compressed in the URL (HTTP Redirection Binding) or not compressed in POST body (HTTP POST Binding).
- Displays the decoded SAML authentication request in Proxy Intercept, Proxy History and Repeater tabs.
You can install BApps directly within Burp, via the BApp Store feature in the Burp Extender tool. You can also download them from here, for offline installation into Burp.
Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.