SAML Raider decodes SAML messages carried in HTTP traffic and gives you a SAML view mode next to Raw and Pretty in HTTP History, Replay, Intercept, Search, Sitemap, Automate and Findings.
It has three tabs: the decoded message, the parsed message info, and attacks. From the attacks tab you can wrap signatures (XSW1 to XSW8), re-sign an assertion or a message with a certificate you control, remove signatures, match and replace, insert XXE and XSLT payloads, and apply presets shaped after published SAML CVEs. Every change is previewed as a diff and only written into the request when you apply it.
It also manages the certificates used for re-signing: import, generate self signed, clone an identity provider's certificate, and export or restore the whole store.
- Open Caido, navigate to the
Pluginssidebar page - Find
SAML Raiderand click Install - Done! 🎉
- Go to the SAML Raider Releases tab and download the latest
plugin_package.zipfile - In your Caido instance, navigate to the
Pluginspage, clickInstall Packageand select the downloadedplugin_package.zipfile - Done! 🎉
Open any request carrying a SAML message and pick the SAML view mode.
- SAML Message shows the decoded XML, raw or prettified.
- SAML Message Info shows issuer, subject, conditions, signed elements and any embedded certificates, which you can send to the certificate manager.
- SAML Attacks runs the transformations. Pick one, press Preview, read the diff, then Apply to request.
Attacks are only available where Caido lets a plugin write, which means Replay and Intercept. In HTTP History the tab is read only. Press Ctrl+R to send the request to Replay first.
Enable Settings → Highlight SAML traffic to colour SAML requests in the proxy history.
Join our Discord community and connect with other Caido users! Share your ideas, ask questions, and get involved in discussions around Caido and security testing.
Feel free to contribute! If you'd like to request a feature or report a bug, please create a GitHub Issue.