Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MitmProxy2Swagger: Automagically reverse-engineer REST APIs

github.com

Post reply on HN
Print view View original

31–40 of 82 posts

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#31

Post by erk__ »

soheil wrote: post #28
srameshc wrote: post #26

Obvious question: How to protect against this ?

[flagged]

Only as long as you cannot load your own certificates, which you are able to in a lot of cases. Though on Android you can lock certificates allowed in a app, this can be circumvented though it adds another step. I am unsure if the same is a case for Apples devices, at least you might need jailbreak there.

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#35

Post by RandomRandy »

soheil wrote: post #28
srameshc wrote: post #26

Obvious question: How to protect against this ?

[flagged]

You can read SSL traffic if you're able to install a root certificate on your device and the website/app doesn't use certificate pinning.

I recently used HttpToolkit to reverse engineer a REST endpoint that used SSL encryption

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#37

Post by nejsjsjsbsb »

tecleandor wrote: post #25

I've used this tool in the past with success. Not perfect but it accelerates the work greatly if you can launch a mitm proxy quickly and are familiar with the tool. I've been fighting lately with an API, though. It's not very, let's say, RESTy. It has only one endpoint, and the different "sections" of the API are defined in parameters, so MitmProxy2Swagger doesn't detect them properly :(

Nothing is RESTy
Post reply on HN