mcpField
M
mitm-find-secrets

mitm-find-secrets

github.com/instavmSecurity8772 installsUpdated 13w ago
Repository

About mitm-find-secrets

mitm-find-secrets is a security skill for inspecting a mitmproxy capture in log.txt for exposed credentials. It categorizes findings and reports their locations, masked values, potential impact, and verification steps.

Key features

  1. 01Scans captures for API keys and tokens
  2. 02Checks cloud and payment credentials
  3. 03Looks for third-party and internal secrets
  4. 04Reports masked values and finding locations
  5. 05Includes service, risk, and verification details

Use cases

  1. 01Reviewing a captured session for exposed API keys
  2. 02Checking traffic for cloud or payment credentials
  3. 03Assessing secrets found in responses and configuration files

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/instavm/security-skills --skill mitm-find-secrets

After installing, type/mitm-find-secretsin Claude Code to confirm it loaded.

Details

From the project README

Find Leaked Secrets

Analyze the mitmproxy dump (log.txt) for exposed secrets for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first:

mitmdump --set flow_detail=3 2>&1 | tee log.txt

Secret Types to Find

1. API Keys & Tokens
  • api_key, apiKey, access_key
  • secret_key, secretKey, client_secret
  • token, auth_token, bearer
  • Patterns: Long alphanumeric strings (32+ chars)
2. Cloud Credentials
  • AWS: AKIA... (access key ID)
  • GCP: AIza... (API key)
  • Azure: Connection strings
  • Firebase: Config objects
3. Payment Secrets
  • Merchant salts
  • HMAC keys
  • Encryption keys
  • PCI-sensitive data
4. Third-Party Services
  • SMS gateway credentials
  • Email service keys
  • Analytics tokens
  • CDN secrets
5. Internal Secrets
  • Database credentials
  • Internal API keys
  • JWT secrets
  • Encryption salts

Common Leak Locations

  • JavaScript files
  • Mobile app API calls
  • Error responses with stack traces
  • Debug endpoints
  • Configuration endpoints

Output Format

For each finding:

  • Secret Type: Category of secret
  • Location: Where found (endpoint/file)
  • Value: Partially masked secret
  • Service: What it's used for
  • Risk: Potential impact
  • Verification: How to test if active

Comments

Markdown supported