mcpField
M
mitm-find-enumerable

mitm-find-enumerable

github.com/instavmSecurity8774 installsUpdated 13w ago
Repository

About mitm-find-enumerable

A security skill that examines mitmproxy traffic dumps for endpoints with enumerable identifiers or predictable patterns. It reports candidate parameters, observed ranges, exposed data, and remediation guidance.

Key features

  1. 01Find sequential and predictable IDs
  2. 02Check weakly encoded identifiers
  3. 03Flag missing pagination limits
  4. 04Report patterns, ranges, and exposed data

Use cases

  1. 01Review captured traffic for enumerable endpoints
  2. 02Assess risks from bulk resource retrieval

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/instavm/security-skills --skill mitm-find-enumerable

After installing, type/mitm-find-enumerablein Claude Code to confirm it loaded.

Details

From the project README

Find Enumerable Endpoints

Analyze the mitmproxy dump (log.txt) for enumerable endpoints for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first:

mitmdump --set flow_detail=3 2>&1 | tee log.txt

What Makes an Endpoint Enumerable

1. Sequential IDs
  • /api/user/1, /api/user/2, /api/user/3
  • /order/100001, /order/100002
  • /transaction/TXN00001
2. Predictable Patterns
  • Date-based: /report/2024-01-01
  • Timestamp: /log/1704067200
  • Simple increments in any parameter
3. Weak Encoding
  • Base64 numbers: /profile/MTIzNDU= (12345)
  • Hex: /data/0x1A2B
  • URL-safe base64
4. No Pagination Limits
  • /api/users?limit=999999
  • /search?count=all

Testing Commands

# Sequential iteration
for i in {1..100}; do
  curl -s "https://target.com/api/resource/$i" >> output.json
  sleep 0.5
done

# Base64 iteration
for i in {1000..1100}; do
  id=$(echo -n $i | base64)
  curl -s "https://target.com/api/resource/$id"
done

# Date iteration
for d in {01..31}; do
  curl -s "https://target.com/api/report/2024-01-$d"
done

Output Format

For each finding:

  • Endpoint: URL pattern
  • Parameter: What can be iterated
  • Pattern: Sequential/Base64/Date/etc.
  • Sample Range: Observed values
  • Data Exposed: What each iteration reveals
  • Bulk Test: curl command for mass extraction
  • Fix: Use UUIDs, add auth, rate limit

Comments

Markdown supported