Quimera

Quimera is a browser security inspection extension designed for authorized web application testing. It helps security professionals and developers inspect authentication-related information that exists inside the browser and may not be completely visible through a traditional HTTP proxy. MAIN FEATURES • Inspect and manage browser cookies. • Review Secure, HttpOnly, SameSite, domain, and path attributes. • Inspect localStorage and sessionStorage. • Detect exposed JWTs, tokens, and authentication-related values. • Identify relevant browser-side security findings. • Restrict collection to explicitly authorized websites. • Optionally synchronize authorized hosts with Burp Suite Target Scope. • Optionally send browser observations to the Quimera extension for Burp Suite through a local bridge. BURP SUITE INTEGRATION Quimera is the browser companion to the separate Quimera extension for Burp Suite. The integration is optional and disabled by default. When explicitly enabled by the user, the browser extension connects only to the Quimera bridge running locally on 127.0.0.1. Pairing requires a user-provided token. The browser extension also works independently without Burp Suite. Its Cookies, Storage, and Vulns sections can be used as standalone inspection tools. PRIVACY AND SECURITY Quimera does not transmit browsing information to developer-operated or third-party servers. Website access and the local Burp bridge must be explicitly authorized by the user. Collected observations are processed locally in the browser or, when the optional bridge is enabled, sent only to the locally running Quimera Burp extension. Quimera is intended exclusively for testing systems that you own or are explicitly authorized to assess. OPEN-SOURCE ORIGIN Quimera is based on the open-source Cookie-Editor browser extension and extends it with Web Storage inspection, browser-side authentication analysis, security findings, scope controls, and optional Burp Suite integration. Source code: https://github.com/B3XAL/Quimera-extension