mitm-find-enumerable

# Find Enumerable Endpoints Analyze the mitmproxy dump (log.txt) for enumerable endpoints for: $ARGUMENTS > **Requires**: `log.txt` in the current directory. If it's missing, capture traffic first: > ```bash > mitmdump --set flow_detail=3 2>&1 | tee log.txt > ``` ## What Makes an Endpoint Enumerable ### 1. Sequential IDs - `/api/user/1`, `/api/user/2`, `/api/user/3` - `/order/100001`, `/order/100002` - `/transaction/TXN00001` ### 2. Predictable Patterns - Date-based: `/report/2024-01-01` - Timestamp: `/log/1704067200` - Simple increments in any parameter ### 3. Weak Encoding - Base64 numbers: `/profile/MTIzNDU=` (12345) - Hex: `/data/0x1A2B` - URL-safe base64 ### 4. No Pagination Limits - `/api/users?limit=999999` - `/search?count=all` ## Testing Commands ```bash # Sequential iteration for i in {1..100}; do curl -s "https://target.com/api/resource/$i" >> output.json sleep 0.5 done # Base64 iteration for i in {1000..1100}; do id=$(echo -n $i | base64) curl -s "https://target.com/api/resource/$id" done # Date iteration for d in {01..31}; do curl -s "https://target.com/api/report/2024-01-$d" done ``` ## Output Format For each finding: - **Endpoint**: URL pattern - **Parameter**: What can be iterated - **Pattern**: Sequential/Base64/Date/etc. - **Sample Range**: Observed values - **Data Exposed**: What each iteration reveals - **Bulk Test**: curl command for mass extraction - **Fix**: Use UUIDs, add auth, rate limit