mcpField
M
mitm-find-otp

mitm-find-otp

github.com/instavmSecurity8776 installsUpdated 13w ago
Repository

About mitm-find-otp

A security skill that reviews a mitmproxy traffic dump for OTP vulnerabilities and formats findings with evidence, impact, and remediation guidance. It is intended for security testing of OTP flows.

Key features

  1. 01Detect OTPs in responses and URLs
  2. 02Check rate limits and verification bypasses
  3. 03Identify predictable or reused OTPs
  4. 04Report evidence, impact, and fixes

Use cases

  1. 01Review captured OTP send and verify requests
  2. 02Assess brute-force and OTP leakage risks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/instavm/security-skills --skill mitm-find-otp

After installing, type/mitm-find-otpin Claude Code to confirm it loaded.

Details

From the project README

Find OTP Vulnerabilities

Analyze the mitmproxy dump (log.txt) for OTP issues for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first:

mitmdump --set flow_detail=3 2>&1 | tee log.txt

Vulnerability Types

1. OTP in Response
  • OTP returned in API response body
  • OTP in page source/JavaScript
  • OTP in error messages
  • Should only be sent via SMS/email, never in API response
2. No Rate Limiting
  • Unlimited OTP generation requests
  • Unlimited verification attempts
  • Can brute force 4-6 digit OTP
3. OTP Bypass
  • Response manipulation bypasses OTP
  • Changing verified: false to verified: true
  • Empty OTP accepted
  • Old OTP still valid
4. Predictable OTP
  • Sequential OTPs
  • Timestamp-based OTPs
  • Same OTP for multiple requests
5. OTP Leakage
  • OTP in URL parameters (logged)
  • OTP visible in function names in source
  • OTP sent in GET request

Testing Approach

# Check for OTP in response
curl -X POST "https://target.com/api/send-otp" \
  -d "phone=1234567890" | grep -i otp

# Test rate limiting
for i in {1..20}; do
  curl -X POST "https://target.com/api/verify-otp" \
    -d "phone=1234567890&otp=$i"
done

# Test with empty/invalid OTP
curl -X POST "https://target.com/api/verify-otp" \
  -d "phone=1234567890&otp="

Output Format

For each finding:

  • Endpoint: OTP send/verify URL
  • Issue: Type of vulnerability
  • Evidence: What was observed
  • Exploit: Steps to reproduce
  • Impact: Account takeover risk
  • Fix: Server-side validation, rate limiting

Comments

Markdown supported