All the data can be yours: reverse engineering APIs

Re:All the data can be yours: reverse engineering APIs by colesantiago on Monday November 11, 2024 @03:46PM (#42110281)

Most of these techniques is extremely old and outdated.

Teams that I've seen working on apps now implement much stronger checks on APIs especially Android apps such as SafetyCheck and DeviceCheck and other methods, which makes using strings rather basic to see them.

And most apps are now encrypted so you just see junk in the logs.

[ Parent | on HN ]

Re:All the data can be yours: reverse engineering APIs by rozap on Monday November 11, 2024 @05:32PM (#42111047)

And on the web side, fingerprinting is rampant and there are JS challenges in cloudflare, imperva, etc which make it trickier. Frustrating to run a whole browser with a virtual screen, load the whole page which is ofc like 15mb of JS and other trash, just to do a very simple thing.

Granted, smaller fish like the ones OP is referring to generally don't have aggressive anti automation measures in place, so it can be easy...but generally these techniques don't work if the operator has put the proper measures in place.

[ Parent | on HN ]

Re:All the data can be yours: reverse engineering APIs by skilbjo on Tuesday November 12, 2024 @01:46AM (#42113356)

take a look at https://xhr.dev/, a product I built to avoid bot detection from things like cloudflare, imperva, aws waf, and others

[ Parent | on HN ]

Re:All the data can be yours: reverse engineering APIs by Zopieux on Tuesday November 12, 2024 @03:12PM (#42119205)

>self host (Docker): $60k/yr

lmao ok

[ Parent | on HN ]

Re:All the data can be yours: reverse engineering APIs by enahs-sf on Tuesday November 12, 2024 @05:06PM (#42120289)

What does the $500 a month get me? Infinite resources to scrape all of LinkedIn?

[ Parent | on HN ]

Re:All the data can be yours: reverse engineering APIs by imp0cat on Tuesday November 12, 2024 @03:18PM (#42119272)

Frustrating? Yeah! but it works SO great! I especially like Playwright in this context, it can do pretty much anything and is a joy to use.

[ Parent | on HN ]

Re:All the data can be yours: reverse engineering APIs by filleokus on Monday November 11, 2024 @06:29PM (#42111376)

Is there a drop-in "thing" for using DeviceCheck? I would guess that something like Auth0 uses it (or maybe not? [0]). It seems like this could be a feature in any API Gateway / WAF'y product?

Not that I'm hoping for it, I too like to play around like OP. But I'm surprised how little I've encountered it in the wild.

[0]: https://github.com/search?q=org%3Aauth0%20DCDevice&type=code

[ Parent | on HN ]