61–70 of 82 posts
1. https://github.com/BandarLabs/clickclickclick - It does that and I am one of the authors.
perhaps a n00b question, but would this work, or is there something similar for apps, specifically android apps?
I use burp suite combined with Frida (which can remove root check and override ssl pinning).
I've used this tool in the past with success. Not perfect but it accelerates the work greatly if you can launch a mitm proxy quickly and are familiar with the tool. I've been fighting lately with an API, though. It's not very, let's say, RESTy. It has only one endpoint, and the different "sections" of the API are defined in parameters, so MitmProxy2Swagger doesn't detect them properly :(
> It's not very, let's say, RESTy. It has only one endpoint, To be fair, from what I understand an actual(tm) REST API would only have a single defined endpoint[1]: the entry point. With every other endpoint being discovered from the responses. And also from your message I'm guessing a URI still uniquely identifies a resource (specifically through the "query" part of the URI, instead of the more common "path"). So, t…
did i miss something or why are there TWO (2) "magically reverse engineer REST APIs" projects on the HN front page right now? is there some offline beef going on? (screenshot in case this goes away https://x.com/swyx/status/1874762725383188502 )
[flagged]
Earlier quoted context omitted.
It's a valid desire, but you have to be really dedicated to the effort to block it, in practice. You might intend your API to be consumed only by your own clients. E.g. your published mobile apps. A well-designed API won't allow a third-party client to do anything that your own client wouldn't allow of course. Permissions are always enforced on the back end. But there are many cases where a user might want a custom/d…
Those sound like bad use cases for a client-server model with public endpoints, then? I mean, you could cert-pin yourself in the client app, I guess.
This is a nice tool. A game I liked to play announced end of service back in 2023. They gave enough notice to let me capture some logs from their cooridinator service. I captured them in mitmproxy and ran those through this to help me identify all the endpoints and their general structure. (A few things were a misnomer, like the examples suggesting certain values were able to be floats when they could only be integer…
Amazing! What game was this for? I was involved in the RE efforts around UO way back in the day.
I was wondering how it would take in graphql endpoints and convert it to swagger, since its just a single POST API with change in params. But thats more of a swagger issue than the tools. Has anyone dealt with this? Would be really helpful if you could share your ideas too :)
Why would you tho? If you're working against an GraphQL based API, you should be able to pull a schema file. And use that to implement your own API. All you would get from an Mitmproxy is example queries and mutations. With the additional complexity of extra tooling to stich together the schema file
I don't want to sit and read each query to identity where it is in the user flow. So I was thinking if I run this in the background and go through a happy flow, I can get the APIs in order and write an integration test.