Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MitmProxy2Swagger: Automagically reverse-engineer REST APIs

github.com

Post reply on HN
Print view View original

21–30 of 82 posts

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#22

Post by devjab »

colesantiago wrote: post #9

Again, this is the very easy part of the reverse engineering API process that most tools can do, similar to API Parrot and the rest of them. This is not hard to do. The hard part is that inevitably, all these internal APIs will just add aggressive CAPTCHAs, Device Check, fingerprinting, etc to prevent common drive by re'ing. Easy to add these on the defence side, and extremely difficult to bypass on the other side. I…

I curious as to why people would have a public API to begin with if they wanted to protect it from people using it. Then again, why would anyone have a public undocumented API in 2024 when a LLM can give you a cli tool to auto-generate 90% of the OpenAPI spec in a couple of hours? The last question isn't serious, I've worked in enterprise for decades and almost none of the tools organisations end up buying have good documentation for their API's. Not that those are publicly available, but still.

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#23

Post by littlestymaar »

swyx wrote: post #15

did i miss something or why are there TWO (2) "magically reverse engineer REST APIs" projects on the HN front page right now? is there some offline beef going on? (screenshot in case this goes away https://x.com/swyx/status/1874762725383188502 )

Likely because of this comment[1] in the other thread which made people submit this link, and when multiple independent people submit the same link in a short period of time you're very likely to end up on the front page (this exact situation happened to me once)

[1] https://news.ycombinator.com/item?id=42568121

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#24

Post by tecleandor »

youngNed wrote: post #18

perhaps a n00b question, but would this work, or is there something similar for apps, specifically android apps?

I've used this specific tool to help me reverse engineer the private API of an Android App.

The thing is, depending on how hardened the app is, you'll have to play with Android to allow this interception, mostly because of certificate pinning. Also I remember something about apps not using the system wide trusted certificates you install (IIRC).

I remember using a rooted device with LineageOS, and downloading the APK and modifying it with a tool so the self signed certificate for the mitm proxy works with it.

The mitm proxy docs have some links to tools that can do that [0] and you could also use an Android emulator if you don't have an extra phone to mess with it [1]

  0: https://docs.mitmproxy.org/stable/concepts-certificates/
  1: https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android/

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#25

Post by tecleandor »

I've used this tool in the past with success. Not perfect but it accelerates the work greatly if you can launch a mitm proxy quickly and are familiar with the tool.

I've been fighting lately with an API, though. It's not very, let's say, RESTy. It has only one endpoint, and the different "sections" of the API are defined in parameters, so MitmProxy2Swagger doesn't detect them properly :(

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#29

Post by K0nserv »

srameshc wrote: post #26

Obvious question: How to protect against this ?

Your first line of defence should be a secure API where an attacker doesn't gain anything by knowing it.

You can add obfuscation, but ultimately if the client is shipped to the user you must assume an attacker can reverse engineer it.

Post reply on HN