<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# SAML Configuration Auditing — API Reference

## SAMLRaider (Burp Extension)

### XSW Attack Variants

| Variant | Technique | Description |
|---------|-----------|-------------|
| XSW1 | Signature relocation | Move Signature, inject unsigned assertion |
| XSW2 | Signature detach | Detach from assertion, wrap evil assertion |
| XSW3 | Pre-insertion | Insert evil assertion before signed |
| XSW4 | Sibling insertion | Evil assertion as sibling to signed |
| XSW5 | Extensions wrap | Move signed into Extensions element |
| XSW6 | Object insertion | Evil assertion in Signature Object |
| XSW7 | Extensions evil | Insert evil Extensions with assertion |
| XSW8 | Post-append | Append evil assertion after Signature |

## xmlsec1 Commands

```bash
# Verify XML signature
xmlsec1 --verify --pubkey-cert-pem cert.pem response.xml

# Sign XML document
xmlsec1 --sign --privkey-pem key.pem --output signed.xml template.xml

# List signature references
xmlsec1 --verify --print-debug response.xml 2>&1 | grep "Reference"
```

## SAML Metadata Analysis

```bash
# Extract entity ID
xmllint --xpath "string(//*[local-name()='EntityDescriptor']/@entityID)" metadata.xml

# Extract ACS URLs
xmllint --xpath "//*[local-name()='AssertionConsumerService']/@Location" metadata.xml

# Extract certificates
xmllint --xpath "//*[local-name()='X509Certificate']/text()" metadata.xml

# Validate certificate
echo "CERT_BASE64" | base64 -d | openssl x509 -inform DER -text -noout
```

## Python signxml Library

```python
from signxml import XMLVerifier, XMLSigner

# Verify signed XML
verified_data = XMLVerifier().verify(xml_string, x509_cert=cert_pem)

# Sign XML
signed_xml = XMLSigner().sign(xml_doc, key=private_key, cert=cert_pem)
```

## Key Validation Checks

| Check | Method | Pass Criteria |
|-------|--------|---------------|
| Signature validity | xmlsec1 --verify | Valid signature |
| Assertion signed | Check Signature in Assertion | Present |
| Response signed | Check Signature in Response | Present |
| AudienceRestriction | XPath check | Contains SP entityID |
| NotOnOrAfter | Timestamp comparison | Within ≤5 min window |
| Recipient | ACS URL match | Matches SP ACS |
| InResponseTo | Request correlation | Matches AuthnRequest ID |
