SAML

SAML Forge decode · attack · forge

← All Tools

SAML Token Input

Parsed XML

Decode a token to see highlighted XML

Key Fields

Key fields will appear here after decode

Attributes

Attribute assertions will appear here after decode

Edit XML modify before generating attacks

Attack Payloads select · configure · generate

Signature Stripping

Remove <ds:Signature> block entirely — some SPs skip validation when no signature is present.

Strip target

                Removes every <ds:Signature> element found in the assertion.
              

XML Signature Wrapping (XSW)

Valid signature covers decoy; SP processes attacker-controlled element. 3 variants.

Injection mode

NameID value

XSW Variant

Comment Injection

Insert  inside an element's text — parsers (Xerces) strip comment nodes, concatenating the surrounding text nodes.

Target

Before comment

After comment

                Result: 

                Vulnerable parsers (Java/Xerces) strip the comment node and concatenate text nodes — the SP sees the joined string.

Attribute Injection

Add or overwrite any attribute in the AttributeStatement. Re-encodes the modified assertion.

Attribute Name

Attribute Value

Action

XSLT Injection

Inject a malicious <ds:Transform> — vulnerable SAML libraries (Xalan, Saxon) execute embedded XSLT during signature processing.

Payload type

Target

XXE in SAML

Inject DOCTYPE with external entity reference into SAML XML for server-side XXE exploitation.

Entity Type

Target URI / File

Attack Output

Select an attack and click "Generate Payload"