mitm-find-pii

name	mitm-find-pii
description	Find PII (Personally Identifiable Information) leakage in API responses. Use when user asks about data exposure, privacy issues, or sensitive data in traffic.

Find PII Leakage

Analyze the mitmproxy dump (log.txt) for PII exposure for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first:

mitmdump --set flow_detail=3 2>&1 | tee log.txt

PII Categories to Check

1. Contact Information

• Email addresses in responses
• Phone numbers (full or partial)
• Physical addresses

2. Financial Data

• Credit card numbers (even partial)
• Bank account details
• Transaction amounts
• Payment tokens

3. Identity Information

• Full names
• Date of birth
• Gender
• PAN/SSN/ID numbers

4. Authentication Data

• Passwords (plain or hashed)
• OTPs in responses
• Session tokens
• API keys

5. Behavioral Data

• Purchase history
• Browsing patterns
• Location data (lat/long)

Red Flags

• PII returned without authentication
• PII in error responses
• PII leaked to third-party domains
• PII in GET parameters (logged in server logs)
• Unmasked data where masking expected

Output Format

For each finding:

• Endpoint: Where PII is exposed
• Data Type: What PII is leaked
• Sample: Redacted example
• Context: Authenticated/Unauthenticated
• Severity: Based on sensitivity
• Fix: Mask, remove, or restrict access