mcpField
M
mitm-find-checksum

mitm-find-checksum

github.com/instavmSecurity8781 installsUpdated 13w ago
Repository

About mitm-find-checksum

mitm-find-checksum is a security-testing skill for finding checksum and signature flaws in mitmproxy traffic logs. It looks for weak algorithms, omitted fields, and unchecked hashes, then organizes findings by endpoint, impact, and suggested fixes.

Key features

  1. 01Analyzes mitmproxy traffic logs
  2. 02Finds checksum and signature parameters
  3. 03Checks weak algorithms and signature collisions
  4. 04Reviews fields covered by hashes
  5. 05Checks whether backends validate hashes

Use cases

  1. 01Review signature validation on payment callbacks
  2. 02Check whether hashes include amount fields
  3. 03Investigate exposed checksum-generation endpoints
  4. 04Document vulnerability impacts and fixes

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/instavm/security-skills --skill mitm-find-checksum

After installing, type/mitm-find-checksumin Claude Code to confirm it loaded.

Details

From the project README

Find Checksum/Signature Vulnerabilities

Analyze the mitmproxy dump (log.txt) for checksum issues for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first:

mitmdump --set flow_detail=3 2>&1 | tee log.txt

Vulnerability Types

1. Checksum Generation Exposed
  • API returns hash even on error
  • Can generate arbitrary checksums
  • Checksum endpoint accessible without auth
2. Weak Algorithms
  • MD5 without salt
  • SHA1 (deprecated)
  • Simple concatenation
3. Signature Collision
  • Same signature for different operations
  • Payment and refund use same algorithm
  • Parameter reordering gives same hash
4. Missing Fields in Checksum
  • Amount not in checksum calculation
  • Status not included
  • Critical fields missing
5. Checksum Not Validated
  • Hash parameter present but ignored
  • Backend accepts any hash value
  • Validation only on specific endpoints

Patterns to Find

# Look for hash/checksum parameters
hash=, checksum=, signature=, sign=, hmac=

# Look for checksum generation APIs
/generateHash, /getChecksum, /createSignature

# Error responses with valid checksums
"error": "...", "checksum": "valid_hash"

Testing Approach

# Test if checksum is validated
curl -X POST "https://target.com/callback" \
  -d "amount=100&status=success&hash=invalid"

# Test checksum generation
curl "https://target.com/api/generateChecksum" \
  -d "amount=1&status=success"

Output Format

For each finding:

  • Endpoint: Where checksum is used
  • Issue: Type of vulnerability
  • Algorithm: If identifiable
  • Fields Included: What's in the hash
  • Exploit: How to bypass/generate
  • Impact: Payment fraud, data tampering
  • Fix: Strong HMAC, include all fields

Comments

Markdown supported