mcpField
M
mitm-security-audit

mitm-security-audit

github.com/instavmSecurity8773 installsUpdated 13w ago
Repository

About mitm-security-audit

mitm-security-audit is a security skill that audits a mitmproxy capture in log.txt against a broad checklist. It is intended for reviewing traffic for authentication, authorization, data exposure, payment, input-validation, and transport issues, with findings prioritized by severity and exploitability.

Key features

  1. 01Enumerates domains and API endpoints
  2. 02Checks authentication, sessions, and IDOR risks
  3. 03Reviews data exposure and leaked secrets
  4. 04Audits payment and input-validation issues
  5. 05Checks transport security and prioritizes findings

Use cases

  1. 01Auditing captured application traffic
  2. 02Reviewing endpoints for access-control weaknesses
  3. 03Assessing payment flows and sensitive data exposure
  4. 04Prioritizing observed security issues for remediation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/instavm/security-skills --skill mitm-security-audit

After installing, type/mitm-security-auditin Claude Code to confirm it loaded.

Details

From the project README

Security Audit of Captured Traffic

Perform a comprehensive security audit of the mitmproxy dump (log.txt) for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first:

mitmdump --set flow_detail=3 2>&1 | tee log.txt

Audit Checklist

Run these checks systematically:

1. Reconnaissance
  • List all unique domains/subdomains seen
  • List all API endpoints with methods
  • Identify API patterns (REST, GraphQL, etc.)
2. Authentication & Session
  • Check for missing authentication on sensitive endpoints
  • Look for session tokens in URLs or GET params
  • Check cookie security flags (Secure, HttpOnly, SameSite)
  • Identify predictable session/token patterns
3. Authorization (IDOR)
  • Find sequential/enumerable IDs in URLs
  • Check for base64 encoded IDs (easy to decode/iterate)
  • Look for user IDs, order IDs, transaction IDs
  • Test if one user's token works for another's resources
4. Data Exposure
  • PII in responses (email, phone, address)
  • Partial/full credit card numbers
  • Passwords or hashes in responses
  • Internal IPs, file paths, stack traces
5. Secrets & Keys
  • API keys in requests/responses
  • Hardcoded tokens or salts
  • Cloud credentials (AWS, GCP, Azure)
  • Third-party service keys
6. Payment Security
  • Checksum/hash validation on callbacks
  • Amount manipulation possibilities
  • Status parameter tampering
  • Signature collision vulnerabilities
7. Input Validation
  • OTP in response (should only be sent via SMS/email)
  • Rate limiting on sensitive endpoints
  • Enumerable endpoints without protection
8. Transport Security
  • HTTP instead of HTTPS for sensitive data
  • Missing security headers
  • Referer leakage to third parties

Output Format

For each finding, provide:

  • Endpoint: The vulnerable URL/API
  • Vulnerability: Type of issue
  • Evidence: What was found in the traffic
  • Severity: Critical/High/Medium/Low/Info
  • Recommendation: How to fix

Prioritize findings by severity and exploitability.

Comments

Markdown supported