SAML Raider - SAML2 Burp Extension


SAML Raider is a Burp Suite extension for testing SAML infrastructures. It contains two core functionalities: Manipulating SAML Messages and manage X.509 certificates.

This software was created by Roland Bischofberger and Emanuel Duss during a bachelor thesis at the Hochschule für Technik Rapperswil (HSR). Our project partner and advisor was Compass Security Schweiz AG. We thank Compass for the nice collaboration and support during our bachelor thesis.


The extension is divided in two parts. A SAML message editor and a certificate management tool.

Message Editor

Features of the SAML Raider message editor:

Message Editor

Certificate Management

Features of the SAML Raider Certificate Management:

Certificate Management


Download: saml-raider-1.2.3.jar


Manual Installation

Start the Burp Suite and click at the Extender tab on Add. Choose the SAML Raider JAR file to install the extension.

Installation from BApp Store

The easy way to install SAML Raider is using the BApp Store. Open Burp and click in the Extender tab on the BApp Store tab. Select SAML Raider and hit the Install button to install our extension.

Don't forget to rate our extension with as many stars you like :smile:.


To test SAML environments more comfortable, you could add a intercept rule in the proxy settings. Add a new rule which checks if a Parameter Name SAMLResponse is in the request. We hope the usage of our extension is mostly self explaining :smile:. If you have questions, don't hesitate to ask us!


Burp Extender API

The Burp Extender API can be found here:


Clone the project into your workspace:

git clone

Import existing project into your Eclipse workspace: FileImport...Existing Projects into Workspace. Select the cloned folder and press Finish.

Download the latest version of Burp Suite as a JAR file and place it in the lib folder.

Add the Burp Suite JAR file to the libraries: Rightclick on Project → PropertiesJava Build PathLibraries and add the JAR file.

Install maven so you can build SAMLRaider using the build automation tool Maven:

$ mvn install

Load the Burp Extension into Burp: ExtenderAdd → select the JAR file (with dependencies) in the ./target directory of the project, like ./target/saml-raider-$VERSION-SNAPSHOT-jar-with-dependencies.jar.

Then you can test the extension and rebuild it again after a change.

Tipp: To reload the extension in Burp, without restarting Burp, hit the Ctrl key and click on the checkbox next to the extension in the Extender tab.

Run SAML Raider inside Eclipse

To start the Extension directly from Eclipse, import the Repository into Eclipse. You can directly import a existing Maven Project. Note that the Eclipse Maven Plugin m2e is required. This is included in the latest "Eclipse IDE for Java Developers".

Place the Burp Suite JAR file into the lib folder and add the Burp JAR as a Library in the Eclipse Project (PropertiesBuild PathLibraries).

Open the Burp JAR under Referenced Libraries in the Package Explorer and right click in the Package burp on StartBurp.class and select Run As...Java Application to start Burp and load the Extension automatically. (Or in Eclipse: RunDebug AsJava ApplicationStartBurp - burpOK.)

Debug Mode

To enable the Debug Mode, set the DEBUG Flag in the Class Flags from the Package helpers to true. This will write all output to the SAMLRaiderDebug.log logfile and load example certificates for testing.

Test with fake SAML Response

To send a SAML Response to Burp, you can use the script samltest in the scripts/samltest directory. It sends the SAML Response from saml_response to Burp (localhost:8080) and prints out the modified response from our plugin. You have to install gawk (GNU awk) as awk and libxml2-utils for the xmllint command.

Feedback, Bugs and Feature Requests

Feedback is welcome! Please contact us or create a new issue on GitHub.

Bachelor Thesis

Our Bachelor thesis is available online and can be found here: eprints_BA_SAML2_Burp_Plugin_SAML_Raider_eduss_rbischof.pdf.


See the LICENSE file (MIT License) for license rights and limitations.