mcpField
M
mitm-find-referer

mitm-find-referer

github.com/instavmSecurity8770 installsUpdated 13w ago
Repository

About mitm-find-referer

A security skill that examines a mitmproxy capture for sensitive information exposed through Referer headers. It reports the external recipient, leaked data, source page, severity, and suggested fixes.

Key features

  1. 01Finds sensitive data in URLs
  2. 02Checks third-party and analytics requests
  3. 03Reviews payment-page referrers
  4. 04Reports source, recipient, severity, and fixes

Use cases

  1. 01Audit captured traffic for Referer leaks
  2. 02Check whether analytics receive sensitive page URLs
  3. 03Review payment pages for exposed transaction data

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/instavm/security-skills --skill mitm-find-referer

After installing, type/mitm-find-refererin Claude Code to confirm it loaded.

Details

From the project README

Find Referer Header Leakage

Analyze the mitmproxy dump (log.txt) for Referer leakage for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first:

mitmdump --set flow_detail=3 2>&1 | tee log.txt

What to Look For

1. Sensitive Data in URLs
  • Tokens in URL being leaked via Referer
  • Session IDs in query parameters
  • User IDs, order IDs in path
  • Payment transaction IDs
2. Third-Party Requests
  • External scripts receiving internal URLs
  • CDN requests with sensitive referers
  • Social widgets getting page URLs
  • External images/fonts leaking URLs
3. Analytics Leakage
  • Google Analytics receiving sensitive URLs
  • Third-party analytics with full page paths
  • Marketing pixels with transaction data
4. Payment Page Leaks
  • Payment IDs leaked to external sites
  • Transaction URLs sent to verification badges
  • "Verified by Visa" logos receiving payment URLs

Vulnerable Patterns

  • External link clicks from sensitive pages
  • Third-party widgets on payment pages
  • Analytics on authenticated pages
  • Social sharing from transaction pages

Output Format

For each finding:

  • External Domain: Who receives the data
  • Leaked Data: What sensitive info is exposed
  • Source Page: Where the leak originates
  • Severity: Based on data sensitivity
  • Fix:
    • Add Referrer-Policy: no-referrer header
    • Use rel="noreferrer" on links
    • Remove sensitive data from URLs
    • Use POST instead of GET for sensitive data

Comments

Markdown supported