Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

github.com

Post reply on HN
Print view View original

81–87 of 87 posts

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#82

Post by instakill »

anon291 wrote: post #71
chatmasta wrote: post #60

Earlier quoted context omitted.

A browser is a user agent, it's some software that makes requests to a server and renders them in a way I can understand. There's no difference between using a screen reader to vocalize content and using an AI agent to summarize it.

Sigh and now you're arguing with me instead of the law, as if I matter. Bits have color and if you don't know what that means, Google that before responding.

I think this is the reference but I'm too lazy to get a TLDR https://news.ycombinator.com/item?id=24917679

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#83

Post by mormegil »

383toast wrote: post #65

What's the stance on security for handling private tokens/cookies/sessions/etc?

My first thought. Do I understand correctly that the HAR with all my session cookies, username&passwords&etc (not mentioning possibly sensitive data in the service) is sent to OpenAPI? Well… just… be aware of it if you want to try this.

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#85

Post by rozap »

shmatt wrote: post #9

I just noticed over the weekend new Claude agreed to reverse engineer a graphql server with introspection turned off, something Im pretty sure it would have refused for ethical reasons before the new version it kept writing scripts, i would paste the output, and it would keep going, until it was able to create its own working discount code on an actual retail website The only issue with these kinds of things is break…

You're right in principle, but I think in practice this is sort of a non issue. Most sites now employ (for better or worse) anti botting tools which have some sort of javascript challenge that will generate a unique token. Given that this tool is only capable of replacing the dynamic parts of the request graph with tokens found in the output from the previous steps, I don't see how it would get around these sorts of challenges. So effectively, if you're using methods to prevent "unauthorized" use of your APIs, I think this sort of tool will be defeated extremely easily. The reverse engineering/web scraping world has unfortunately evolved to be extremely adversarial, and this sort of tool is does not have the sneakiness required to get around even the simplest anti botting measures.

Until LLMs become smart enough to emulate a full JS stack, I think we're safe :)

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#86

Post by TalvinRamnah »

jerrygenser wrote: post #11

Will this work for SSR applications? e.g. think old school net or jsp apps which make network requests then receive HTML which then needs to be parsed in order to understand the key pieces of information and then additional network requests? I've found it relatively straight forward to reverse engineer SPA requests however with server side rendered apps, yow would your service handle that?

Same question from me. I've got this exact use case I've been struggling with the past few days.

I work at a milk delivery company in the UK (The Modern Milkman). There's this website called findmeamilkman.com and I wanted to scrape all the milk delivery services that serve every UK postcodes to create polygons I can overlay on a map to identify competitors in each region.

I keep getting rate limited by the servers, and there doesn't seem to be any fetch/XHR requests on the network. Instead a SSR request that returns the full HTML.

If you're product could help me solve this by reverse engineering an API that would be amazing

Post reply on HN