SAML signature wrapping (XSW)

Jul 23, 2026 · 1 min read

XML signature wrapping exploits a gap between the element that is verified and the element that is processed. Keep the valid signed assertion, add a forged assertion, and structure the document so the processor reads the forged one.

xml


  admin
  ...covers original...
  ...signed, moved into an unused element...

Tooling automates the permutations.

bash

python3 -m saml_raider   # or use the Burp SAML Raider extension to generate XSW1-8

Pro note: try all eight XSW variants because the winning layout depends on whether the library selects the signed node by reference id or by position. Also test comment injection in the NameID (canonicalization splits admin@x<!–comment–>.evil), which some parsers read as admin.