mcpField
M
mitm-find-insecure

mitm-find-insecure

github.com/instavmSecurity8772 installsUpdated 13w ago
Repository

About mitm-find-insecure

mitm-find-insecure is a security skill for checking a mitmproxy capture in log.txt for insecure configurations. It examines transport, headers, cookies, CORS, TLS, and information disclosure, then describes observed values, risks, and recommended settings.

Key features

  1. 01Finds sensitive traffic sent over HTTP
  2. 02Checks security headers and cookie flags
  3. 03Reviews CORS permissions
  4. 04Inspects TLS versions, certificates, and ciphers
  5. 05Reports observed settings, risks, and recommendations

Use cases

  1. 01Checking captured traffic for HTTP use with sensitive data
  2. 02Reviewing response headers and cookie protections
  3. 03Finding permissive CORS or outdated TLS settings
  4. 04Assessing configuration-related information disclosure

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/instavm/security-skills --skill mitm-find-insecure

After installing, type/mitm-find-insecurein Claude Code to confirm it loaded.

Details

From the project README

Find Insecure Configurations

Analyze the mitmproxy dump (log.txt) for insecure configs for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first:

mitmdump --set flow_detail=3 2>&1 | tee log.txt

Security Checks

1. HTTP Instead of HTTPS
  • Sensitive data over plain HTTP
  • Login/payment pages on HTTP
  • Mixed content issues
2. Missing Security Headers
  • Strict-Transport-Security (HSTS)
  • X-Content-Type-Options
  • X-Frame-Options
  • Content-Security-Policy
  • X-XSS-Protection
  • Referrer-Policy
3. Insecure Cookies
  • Missing Secure flag
  • Missing HttpOnly flag
  • Missing SameSite attribute
  • Session cookies without protection
4. CORS Issues
  • Access-Control-Allow-Origin: *
  • Credentials allowed with wildcard
  • Overly permissive origins
5. SSL/TLS Issues
  • SHA1 certificates (deprecated)
  • Weak cipher suites
  • Outdated TLS versions
6. Information Disclosure
  • Sensitive data in GET params
  • Debug/verbose errors exposed
  • Stack traces in responses
  • Internal file paths revealed

Output Format

For each finding:

  • Endpoint/Resource: Where issue exists
  • Issue: What's misconfigured
  • Current Value: What was observed
  • Recommended: Secure configuration
  • Risk: Potential attack vector
  • Severity: Critical/High/Medium/Low/Info

Comments

Markdown supported