Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

github.com

Post reply on HN
Print view View original

61–70 of 87 posts

Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

#61

Post by jeroenhd »

Cilvic wrote: post #58
jeroenhd wrote: post #54

Earlier quoted context omitted.

mitmproxy ( https://mitmproxy.org/ ) has scripting support that will let you do most of this. For example, you can expose mitmproxy, listen to HTTP requests for a specific host (using this API: https://docs.mitmproxy.org/stable/api/mitmproxy/http.html ), intercept the request, do whatever API calls you need, and inject a response without ever forwarding the request to the original server. Alternatively, you could mod…

Ok. This sounds great for easy developing. But when I'm hosting this I'm not a mitmproxy. I want to act like a normal server/endpoint for API A.

I don't know any libraries for this in any good backend languages, but I've worked with these packages in NodeJS to do something like that:

- https://www.npmjs.com/package/http-proxy

- https://www.npmjs.com/package/connect

- https://www.npmjs.com/package/harmon

If you don't want to act like a proxy, you're going to approach this like a normal web applications that does HTTP requests using whatever HTTP client your framework of choice uses.

Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

#62

Post by SOLAR_FIELDS »

metadat wrote: post #59
SOLAR_FIELDS wrote: post #45

Earlier quoted context omitted.

Hilarious indeed! The first thing I thought of with this project is actually AirBnB, because the sort/filter/map view is so terrible and missing features. AirBnB captures data on a bunch of stuff, but doesn't make it possible to search for in the UI (ever want a property with a lake view or a sauna? AirBnB knows which ones have those things, but they won't let you look for them!) AirBnB doesn't have an official API b…

How will this let you search for a sauna?

Easier to modify requests vs doing it using browser tools. The ability to search for the things I mentioned is actually there, but only via an undocumented url parameter that erases itself every time you pan the map. Doing it via REST calls is much easier than trying to do it in the UI.

Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

#63

Post by julianlam »

This is great work!

This would come in very handy for codebases where an OpenAPI v3 spec would be welcome, but is too onerous to create by hand. Run this for a bit, have it spit out a nearly complete spec, and tweak it a bit to output the final product.

In fact, it is precisely what we did to generate the OpenAPI docs for NodeBB [1]. We had an undocumented API that we turned into an OpenAPI v3 file.

[1] https://docs.nodebb.org/api/read

Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

#64

Post by anitil »

alufers wrote: post #2

Wanted to show off my little project which helps whith reverse engneering APIs used by various apps. It takes HTTP traffic capturewd by mitmproxy and generates an OpenAPI specification for a given REST API. I have used it already on two apps and the results are good enough to write an alternative client or quickly automate some stuff.

What a fantastic idea! I have so many half baked things that some idiot (me) built without documenting the underlying API. This will make life so much easier

Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

#65

Post by motoxpro »

SemanticStrengh wrote: post #32
tomatowurst wrote: post #28

Earlier quoted context omitted.

"...and we expect it to be free and open source as our budget for this is zero."

The relationship between actual utility/value and price is only vaguely correlated. Many of the most useful things on earth can't be marketed, not because they're not worth the money but because people are extremely greedy for some kinds of domains and simultaneously are bad at realizing the impact on their lives. E.g I have never spent a single dollar to access music despite being one of the few things in life that…

I'm glad I can subsidize your music hobby and that you feel no sense of guilt for not supporting the people who "bring you intense joy"

Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

#68

Post by olabyne »

Labo333 wrote: post #52

Very nice! On the same note, I wrote a program to generate Python code (requests) from a HAR capture: https://github.com/louisabraham/har2requests I think using HAR captures is simpler for the end user than spawning mitmproxy as they don't require any installation and are extracted from the network tab of the browser devtools. Is there a reason why you didn't use them? EDIT: I realized that mitmproxy can also get tra…

Oh, I used a python script to generate pre-made requests from HAR recently, I'm pretty sure it was your git ! Very useful :)

Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

#69

Post by ludovicianul »

alufers wrote: post #2

Wanted to show off my little project which helps whith reverse engneering APIs used by various apps. It takes HTTP traffic capturewd by mitmproxy and generates an OpenAPI specification for a given REST API. I have used it already on two apps and the results are good enough to write an alternative client or quickly automate some stuff.

This is great :) You can then fuzz your APIs for issues using https://github.com/Endava/cats.

Re: Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

#70

Post by ludovicianul »

aleksiy123 wrote: post #56

Really awesome, I tried my hand at writing something similar and was surprised at how well it actually ended up working. I feel liken the next step is automatically generating load tests and/or fuzzing tests. Felt like that could be a real product.

Here you go: https://github.com/Endava/cats
Post reply on HN