41–50 of 87 posts
Wanted to show off my little project which helps whith reverse engneering APIs used by various apps. It takes HTTP traffic capturewd by mitmproxy and generates an OpenAPI specification for a given REST API. I have used it already on two apps and the results are good enough to write an alternative client or quickly automate some stuff.
This is really incredible. With a rooted android phone and these tools, plus a couple others [1,2,3], you can get a skeleton to implement a backend for any app you want. [1]: https://github.com/koxudaxi/fastapi-code-generator [2]: https://github.com/ioxiocom/openapi-to-fastapi [3]: https://infosecwriteups.com/hail-frida-the-universal-ssl-pin...
Earlier quoted context omitted.
mitmproxy dev here, very awesome! :) This seems to be particularly useful to quickly generate clients for reverse-engineered APIs.
Swagger Editor dev which now works at Airbnb here. This is hilarious!
AirBnB doesn't have an official API but changes the tags so often that scrapers people put up on Github go out of date quickly. Now I can run this whenever I want to have actual search functionality (instead of the hobbled crap available on the website) and ensure that whatever flavor of API is available on the website that day is easily queryable!
Really neat! Gives me an idea on using something like this to generate e.g., CURL commands to mimic SSO flows. Even just documenting an SSO flow as a diagram would be quite neat.
https://everything.curl.dev/usingcurl/copyas#:~:text=From%20....
When it works, it's effing magic! Spectacular for very quickly knocking out Bash scripts that test multiple APIs.
step 2: features for training a language model on the request and response variables in the mitm stream and a shim for standing up a fully ml data driven zero code mock backend.
Is it possible to do this on wireshark/tcpdump pcap dumps? Like for finding out hostnames, endpoints and request packets of HTTPS requests that an android app is making?
The problem with pcap is that whe requests there would be encrypted and basically there is no way to practically decrypt them. Mitmproxy solves that by being between the client and server and injecting it's own self-signed certificate (which you need to add to the trusted certificates on the phone, which requires root).
This is really incredible. With a rooted android phone and these tools, plus a couple others [1,2,3], you can get a skeleton to implement a backend for any app you want. [1]: https://github.com/koxudaxi/fastapi-code-generator [2]: https://github.com/ioxiocom/openapi-to-fastapi [3]: https://infosecwriteups.com/hail-frida-the-universal-ssl-pin...