ICARUS

---

📖 Table of Contents

• Overview
• Core Features
• Extension Modules
• Installation & Compilation
• Usage Guidelines
• Changelog
• Disclaimer
• License

---

🎯 Overview

ICARUS is a comprehensive, enterprise-grade security testing extension for Burp Suite. Designed to automate and streamline API security assessments, it brings powerful vulnerability detection, intelligent fuzzing, and smart evidence capture directly into your Burp workflow. By centralizing operations within a unified interface, ICARUS accelerates security workflows from discovery to reporting.

---

✨ Core Features

• Unified Command Interface: A centralized control panel (ICARUS tab) for configuring all modules, tracking active tasks, and managing vulnerability findings in real-time.
• AutoAuth: Replaces clunky Burp Macros with a highlight-and-click workflow — mark a token in a response as the source, mark where it needs to go in a request, and ICARUS silently keeps it fresh and injected in the background from then on.
• Evidence Manager & Reporting: One-click Apply renders a screenshot and registers the finding straight into the report — no save dialog. Offline CWE tagging with typeahead, a drag-and-drop Evidence Manager to curate and reorder findings, and a browser preview step before exporting a polished HTML or PDF report.
• Passive Threat Detection: Background monitoring that flags server errors and verbose error/stack-trace leaks as they cross the proxy, with a lightweight toast notification so you know to check the Results tab.
• Automated Rapid Scanning: Execute comprehensive security checks against selected HTTP requests with a single click directly from the Burp context menu.

---

🧩 Extension Modules

ICARUS integrates multiple specialized security testing engines into a single cohesive extension. Click to expand each module's technical capabilities:

1. JSON Input Validation (ParamValidator)

Focuses on rigorous testing of JSON request parameter validation to determine if the backend API processes malformed or malicious inputs that violate the expected schema contract.

• Structural Validation: Identifies missing enforcement of null values, removed fields, and empty objects/arrays.
• Type Confusion: Tests for unsafe type casting (e.g., passing strings as booleans/integers).
• Boundary Testing: Validates enforcement of limits using empty strings, excessive lengths, and negative boundaries.
• Injection Payloads: Automates the discovery of SQLi, XSS, NoSQL injection, and Path Traversal vulnerabilities.

2. HTTP Verb Tester (HttpVerbModule)

Performs exhaustive HTTP verb validation for API security testing, automatically mutating standard requests using alternate methods (`GET`, `HEAD`, `POST`, `OPTIONS`, `TRACE`, etc.) to uncover endpoint misconfigurations.

• Automatically adjusts request body content based on the injected HTTP method.
• Provides deep OPTIONS and Allow header validation.
• Detects unsafe TRACE reflection vulnerabilities.

3. JWT / Bearer Token Checker (JwtCheckerModule)

A robust engine for detecting, parsing, and exploiting JSON Web Tokens (JWTs) and Bearer tokens for critical security flaws.

• Automated Discovery: Hunts for JWTs across all standard HTTP headers and cookies.
• Algorithm Analysis: Detects weak configurations (e.g., alg=none bypasses) and flags unsafe embedded claims (jwk, jku, kid).
• Payload Tampering: Attempts automatic privilege escalation by manipulating common claims (admin, role, scope).
• Signature Attacks: Tests endpoint resilience against improper signature validation and signature stripping.
• Time-based Attacks: Detects missing exp/iat claims to prevent token expiration bypasses.

4. Rate Limit Tester (RateLimitModule)

Executes high-velocity requests to accurately detect, characterize, and attempt bypasses on API rate limiting implementations.

• Burst Detection: Determines active throttling behaviors and block thresholds.
• Highly Configurable: Granular control over request counts, concurrency, and timing delays.
• Advanced Evidence: Captures precise Requests Per Second (RPS) metrics and timestamps for accurate reporting.

5. Sensitive Header Scanner (SensitiveHeaderModule)

Passively and actively inspects HTTP responses for sensitive header disclosures or caching misconfigurations that could lead to critical data leakage.

6. Export to Postman (PostmanExportModule)

Streamlines cross-team collaboration by exporting complex, active HTTP requests directly into a standard Postman Collection JSON format.

• Accurately extracts the HTTP method, headers, and intricate URL structures.
• Secures complex body payloads with proper JSON escaping.

7. AutoAuth (AutoAuthModule)

Replaces Burp's Macros with a highlight-and-click workflow for managing authentication tokens, so expired sessions never interrupt a testing flow again.

• Highlight & Click Setup: Right-click a token value in a response → "Set as Auth Token Source". Right-click a header or JSON field in a request → "Add Auth Token Destination".
• Silent Background Refresh: Detects an expired cached token, quietly re-fetches it from the source request, and injects it into every matching outgoing request.
• Host-Scoped Injection: A token captured from one site can never leak into another site's requests.
• Persistent: Your source/destination mapping survives extension reloads and Burp restarts.

8. Passive Error Detector (PassiveErrorModule)

Runs quietly in the background, flagging HTTP 500+ responses and verbose error/stack-trace leaks (SQL errors, framework tracebacks, etc.) as they cross the proxy — no manual scan required.

9. Evidence Manager & Reporting

Turns raw HTTP traffic into a client-ready report with minimal manual effort — from capture to a polished HTML or PDF deliverable.

• Send to Reporter Creation: right-click any request/response — Repeater, Proxy, Logger, anywhere Burp shows one — or hit Ctrl+P. Automatic detection of verbose error disclosures and unencoded reflections pre-populates the title, description, and severity.
• One-Click Apply: renders the evidence screenshot, saves it, and registers the finding straight into the report — no save dialog, no separate step. A secondary "Annotate First…" option still offers the full image editor (box, arrow, highlight, redact, copy-to-clipboard) for findings that need manual markup.
• Offline CWE Tagging: instant typeahead against a bundled CWE dataset, zero network calls, rendered as a tagged row in the final report.
• Import from Proxy History: pull any past request into the evidence flow without needing to run a scan on it first.
• Evidence Manager window (right-click → "Manage Report Evidence", or the Results tab): live preview of every captured screenshot, drag-and-drop reordering, an include/exclude toggle to leave a finding out of the next report without deleting its evidence, and an optional executive summary field.
• Preview & Export: preview the actual rendered report in your browser before committing to a save location, then export as HTML or PDF (via OpenPDF, fully offline) — both share one consistent, readable theme.

---

🚀 Installation & Compilation

1. Compile the Extension
   Run the build script from the icarus-extension/ directory. This script automatically downloads the required Montoya API dependency, compiles the Java source, and packages the JAR.

   cd icarus-extension/
   ./build.sh

   Output will be located at: icarus-extension/build_manual/libs/icarus-<version>.jar

2. Load into Burp Suite

   • Open Burp Suite and navigate to the Extensions tab.
   • Click Add.
   • Select Java as the extension type.
   • Select the generated icarus-<version>.jar file.

---

🛠 Usage Guidelines

• Configuration: Navigate to the dedicated ICARUS tab in the main Burp Suite interface to configure specific module settings, manage your active tasks, and review detailed findings.
• Execution: Right-click any HTTP request in the Repeater, Proxy history, or Target scope, navigate to Extensions → ICARUS, and select an individual module or choose Run All Modules for a full assessment.

---

⚠️ Disclaimer

Warning

These tools are explicitly intended for:

• Security research and vulnerability analysis
• Defensive security engineering
• Authorized penetration testing engagements
• Secure software development lifecycles

You must only use this software against systems, networks, and applications that you are explicitly authorized to test.

---

⚖️ License

ICARUS is open-sourced software licensed under the MIT License.