Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MitmProxy2Swagger: Automagically reverse-engineer REST APIs

github.com

Post reply on HN
Print view View original

1–10 of 82 posts

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#2

Post by Gamemaster1379 »

This is a nice tool. A game I liked to play announced end of service back in 2023. They gave enough notice to let me capture some logs from their cooridinator service.

I captured them in mitmproxy and ran those through this to help me identify all the endpoints and their general structure. (A few things were a misnomer, like the examples suggesting certain values were able to be floats when they could only be integers)

I was able to get a team together and we were able to stand up private servers as a result.

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#4

Post by simonjgreen »

Gamemaster1379 wrote: post #2

This is a nice tool. A game I liked to play announced end of service back in 2023. They gave enough notice to let me capture some logs from their cooridinator service. I captured them in mitmproxy and ran those through this to help me identify all the endpoints and their general structure. (A few things were a misnomer, like the examples suggesting certain values were able to be floats when they could only be integer…

Amazing! What game was this for? I was involved in the RE efforts around UO way back in the day.

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#8

Post by zebomon »

I looked through this earlier today when I saw it mentioned in that thread about the closed source tool for the same purpose.

Having done a good bit of this type of reverse engineering the hard way over the years, it's a very exciting find. I had been talking with my partner about building something similar for the past six months. How exciting to learn that it's already out there and open source too!

Re: MitmProxy2Swagger: Automagically reverse-engineer REST APIs

#9

Post by colesantiago »

Again, this is the very easy part of the reverse engineering API process that most tools can do, similar to API Parrot and the rest of them. This is not hard to do.

The hard part is that inevitably, all these internal APIs will just add aggressive CAPTCHAs, Device Check, fingerprinting, etc to prevent common drive by re'ing. Easy to add these on the defence side, and extremely difficult to bypass on the other side.

I can imagine all developer teams now upping their security with the combination of the above mentioned to prevent this.

Post reply on HN