search

CompassSecurity / SAMLRaider

SAML2 Burp Extension
MIT License
401 stars 74 forks source link

XSW attacks are losing whitespace in Signature #12

Open pratikd650 opened 8 years ago

pratikd650 commented 8 years ago

I am trying XSW1 but the signature is turning out to be invalid after the transformation.

Turns out the SAML Raider is losing whitespace, and so the canonicalized output is different. Initial SignedInfo (generated by Shibboleth - notice that there is no indent, but newline after every element)

<ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></ds:SignatureMethod>
<ds:Reference URI="#_a544335059b58b98d30e75524e09627c">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Transform>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></ds:DigestMethod>
<ds:DigestValue>t9htoNyes3QdccTS57Dp1QOO6oTz8MxON+QYqqgIF3I=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>

SignedInfo after XSW1. (notice that all the newlines are gone)

<ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></ds:SignatureMethod><ds:Reference URI="#_a544335059b58b98d30e75524e09627c"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Transform><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></ds:DigestMethod><ds:DigestValue>t9htoNyes3QdccTS57Dp1QOO6oTz8MxON+QYqqgIF3I=</ds:DigestValue></ds:Reference></ds:SignedInfo>

Is there some option to preserve the whitespace?

lindi2 commented 5 years ago

This could actually be seen as a duplicate of https://github.com/SAMLRaider/SAMLRaider/issues/7 , right?