51–60 of 87 posts
I'm looking for a generic tool to build and then serve:
Accept Incoming request (API contract A) Send outgoing request (API contract B) potentially with parameters from the incoming request Receiving incoming response (API contract B) Do some translations/string manipulation Send outgoing response (API contract A)
On the same note, I wrote a program to generate Python code (requests) from a HAR capture: https://github.com/louisabraham/har2requests
I think using HAR captures is simpler for the end user than spawning mitmproxy as they don't require any installation and are extracted from the network tab of the browser devtools. Is there a reason why you didn't use them?
EDIT: I realized that mitmproxy can also get traffic from other devices like phones. Very cool project, I will think about modifying mine to support mitmproxy captures!
This is really incredible. With a rooted android phone and these tools, plus a couple others [1,2,3], you can get a skeleton to implement a backend for any app you want. [1]: https://github.com/koxudaxi/fastapi-code-generator [2]: https://github.com/ioxiocom/openapi-to-fastapi [3]: https://infosecwriteups.com/hail-frida-the-universal-ssl-pin...
That's interesting, but it won't work with native code that statically links a SSL implementation.
If you're really intent on getting it to work, downloading the binary, patching out the verification function and putting it back is also possible if you're root.
[1]: https://frida.re/docs/android/
[2]: https://mobsecguys.medium.com/exploring-native-functions-wit...
The question is maybe a bit off-topic a d vague. That's because I struggle to express it with the right terms: I'm looking for a generic tool to build and then serve: Accept Incoming request (API contract A) Send outgoing request (API contract B) potentially with parameters from the incoming request Receiving incoming response (API contract B) Do some translations/string manipulation Send outgoing response (API contr…
For example, you can expose mitmproxy, listen to HTTP requests for a specific host (using this API: https://docs.mitmproxy.org/stable/api/mitmproxy/http.html), intercept the request, do whatever API calls you need, and inject a response without ever forwarding the request to the original server.
Alternatively, you could modify the request and then change the request destination, like in this example here: https://docs.mitmproxy.org/stable/addons-examples/#http-redi.... Using the WSGI support, you could even use normal Python annotations to build your own API without doing too much pattern matching: https://docs.mitmproxy.org/stable/addons-examples/#wsgi-flas...
Starred. Does this work with non-emulated iOS or Android http calls in which you may need to disable app level security?
However, many apps apply cert pinning in production builds, which will require tools like Frida to disable them, which in turn requires root access/a jailbreak to function.
Alternatively, you could pull the apps from your phone without root (at least on Android), patch the most obvious cert pinning out (usually in the network manifest file) and install the new version.
I feel liken the next step is automatically generating load tests and/or fuzzing tests. Felt like that could be a real product.
this is absolutely insane!!! I understand capturing the REST api network part, is it then examining the request body, headers being sent back and forth to figure out the API?
Yes, this is basically what this program does.
The question is maybe a bit off-topic a d vague. That's because I struggle to express it with the right terms: I'm looking for a generic tool to build and then serve: Accept Incoming request (API contract A) Send outgoing request (API contract B) potentially with parameters from the incoming request Receiving incoming response (API contract B) Do some translations/string manipulation Send outgoing response (API contr…
mitmproxy ( https://mitmproxy.org/ ) has scripting support that will let you do most of this. For example, you can expose mitmproxy, listen to HTTP requests for a specific host (using this API: https://docs.mitmproxy.org/stable/api/mitmproxy/http.html ), intercept the request, do whatever API calls you need, and inject a response without ever forwarding the request to the original server. Alternatively, you could mod…
Earlier quoted context omitted.
Swagger Editor dev which now works at Airbnb here. This is hilarious!
Hilarious indeed! The first thing I thought of with this project is actually AirBnB, because the sort/filter/map view is so terrible and missing features. AirBnB captures data on a bunch of stuff, but doesn't make it possible to search for in the UI (ever want a property with a lake view or a sauna? AirBnB knows which ones have those things, but they won't let you look for them!) AirBnB doesn't have an official API b…