How did you bypass cert pinning in the video for the Airbnb app?
I didn't, just added a self-signed cert to my keychain on macOS and launched the app as downloaded from App Store.
I guess Airbnb doesn't use cert pinning.
Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
31–40 of 87 posts
Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
#32Earlier quoted context omitted.
of course the generated doc should be refined (e.g. filling missing types, error codes) but your lib would save us a lot of work and make the world a better place.
"...and we expect it to be free and open source as our budget for this is zero."
The relationship between actual utility/value and price is only vaguely correlated.
Many of the most useful things on earth can't be marketed, not because they're not worth the money but because people are extremely greedy for some kinds of domains and simultaneously are bad at realizing the impact on their lives.
E.g I have never spent a single dollar to access music despite being one of the few things in life that brings me intense joy
Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
#33How did you bypass cert pinning in the video for the Airbnb app?
It doesn't have anything to do with mobile. The web client uses the same APIs.
Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
#34This is really incredible. With a rooted android phone and these tools, plus a couple others [1,2,3], you can get a skeleton to implement a backend for any app you want.
[1]: https://github.com/koxudaxi/fastapi-code-generator
[2]: https://github.com/ioxiocom/openapi-to-fastapi
[3]: https://infosecwriteups.com/hail-frida-the-universal-ssl-pin...
Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
#35Is it possible to do this on wireshark/tcpdump pcap dumps? Like for finding out hostnames, endpoints and request packets of HTTPS requests that an android app is making?
Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
#36awesome take
Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
#37Really neat! Gives me an idea on using something like this to generate e.g., CURL commands to mimic SSO flows.
Even just documenting an SSO flow as a diagram would be quite neat.
Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
#38Hi, I would also like to add another tool I'm contributing to at work (cisco) called APIClarity [1]. It aims at reconstructing swagger specifications of REST microservices running in K8S, but can also be run locally.
This is a challenging task and we don't support OpenAPI v3 specs yet (we are working on it).
Feel free to have a look, and get ideas from it :)
We'll also be presenting it at next Kubecon 2022.
Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
#39Really amazing.
We're having hundreds of undocumented endpoints created over the years, and running this tool on our backends will create instantly good documentation
Thanks for that! Will give feedbacks if any issues
Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs
#40Is it possible to do this on wireshark/tcpdump pcap dumps? Like for finding out hostnames, endpoints and request packets of HTTPS requests that an android app is making?
The problem with pcap is that whe requests there would be encrypted and basically there is no way to practically decrypt them.
Mitmproxy solves that by being between the client and server and injecting it's own self-signed certificate (which you need to add to the trusted certificates on the phone, which requires root).