Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MitmProxy2Swagger: Automagically reverse-engineer REST APIs

github.com

Post reply on HN
Print view View original

11–20 of 82 posts

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#11

Post by sebmellen »

colesantiago wrote: post #9

Again, this is the very easy part of the reverse engineering API process that most tools can do, similar to API Parrot and the rest of them. This is not hard to do. The hard part is that inevitably, all these internal APIs will just add aggressive CAPTCHAs, Device Check, fingerprinting, etc to prevent common drive by re'ing. Easy to add these on the defence side, and extremely difficult to bypass on the other side. I…

Depends on the age of the tool. We work with a lot of legacy systems that actually want us to integrate with them but don’t have the dev resources to build a proper API surface. As a result, we end up doing a lot of painful reverse engineering. These tools look promising for purposes like this.

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#12

Post by notcrazylol »

I was wondering how it would take in graphql endpoints and convert it to swagger, since its just a single POST API with change in params. But thats more of a swagger issue than the tools. Has anyone dealt with this? Would be really helpful if you could share your ideas too :)

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#13

Post by asabla »

notcrazylol wrote: post #12

I was wondering how it would take in graphql endpoints and convert it to swagger, since its just a single POST API with change in params. But thats more of a swagger issue than the tools. Has anyone dealt with this? Would be really helpful if you could share your ideas too :)

Why would you tho?

If you're working against an GraphQL based API, you should be able to pull a schema file. And use that to implement your own API.

All you would get from an Mitmproxy is example queries and mutations. With the additional complexity of extra tooling to stich together the schema file

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#14

Post by jampekka »

asabla wrote: post #13
notcrazylol wrote: post #12

I was wondering how it would take in graphql endpoints and convert it to swagger, since its just a single POST API with change in params. But thats more of a swagger issue than the tools. Has anyone dealt with this? Would be really helpful if you could share your ideas too :)

Why would you tho? If you're working against an GraphQL based API, you should be able to pull a schema file. And use that to implement your own API. All you would get from an Mitmproxy is example queries and mutations. With the additional complexity of extra tooling to stich together the schema file

Pulling the schema file can, and often is, disabled server side. And GraphQL APIs can, and often do, decline to serve other than persisted queries, and those can't be really inferred even with known schema.

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#16

Post by Quarrel »

swyx wrote: post #15

did i miss something or why are there TWO (2) "magically reverse engineer REST APIs" projects on the HN front page right now? is there some offline beef going on? (screenshot in case this goes away https://x.com/swyx/status/1874762725383188502 )

Presumably, because the closed source one got some traction, so people are pointing out the open source alternative.

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#17

Post by matthewolfe »

andrewstuart wrote: post #3

This is something that would be easy to do an ordinary job of, missing lots of edge cases and not making something thorough and complete. A really professional and thorough job would be extremely time consuming and hard.

I do this a lot for my work. A tool like this that can help get me to a nice starting point is huge. Instead of developing a mental model of the API in my head by manually looking through API requests/responses in ProxyMan, this can start me off much more quickly. From there, the edge cases can be worked out.

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#19

Post by rhaps0dy »

youngNed wrote: post #18

perhaps a n00b question, but would this work, or is there something similar for apps, specifically android apps?

Depends on the app. If it uses some online functionality probably yes. You could also try decompilation, it’s decent on java apps like android’s.

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#20

Post by whilenot-dev »

youngNed wrote: post #18

perhaps a n00b question, but would this work, or is there something similar for apps, specifically android apps?

A MITM proxy isn't specific to any app, it's a forward proxy for your outgoing network connection. In case of an Android app you'd need to run mitmproxy on a machine in your network and setup the connection as proxy in your Android's network settings. Then you'd need follow http://mitm.it to install mitmproxys root certificate on the Android device (to trust the connection with TLS) and off you go.

EDIT: or rather follow the docs[0]

[0]: https://docs.mitmproxy.org/stable/howto-install-system-trust...

Post reply on HN