[{"data":1,"prerenderedAt":472},["ShallowReactive",2],{"project-31354130":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":42,"post_text":45,"what":46,"said":70,"maker_in_thread":193,"shape":202,"grid":207,"attempts":434,"same_week":435,"maker_shows":18,"maker_hidden":464,"reader_version":465,"card":466},"31354130","Mitmproxy2swagger","Automagically reverse-engineer REST APIs","title","Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs","https:\u002F\u002Fgithub.com\u002Falufers\u002Fmitmproxy2swagger","github.com","alufers",1652363342,2022,691,85,24,2570,1,"legend","dev_tools","api reverse engineering","cli",[24,25,26,27,28],"openapi","mitmproxy","reverse engineering","rest api","swagger","loved",0.592,{"positive":32,"neutral":33,"mixed":34,"critical":18},31,19,0,51,{"idea":37,"execution":39,"docs":41},{"positive":38,"critical":34},22,{"positive":40,"critical":18},2,{"positive":18,"critical":34},[43,44,44,43,44,44,18,44,34,34,44,34,44,43,43,44,44,44,43,44,44,34,34,44,34,34,44,43,43,34,44,44,44,44,44,34,44,44,44,44],3,5,null,{"problem":47,"audience":45,"pricing":45,"motivation":54,"time_to_build":45,"stack":58,"openness":67,"stage":68,"team_size":69},{"value":48,"source":49,"evidence":50},"Undocumented REST APIs used by apps need documentation or clients","maker",[51],{"id":52,"by":11,"text":53},"31354230","Wanted to show off my little project which helps whith reverse engneering APIs used by various apps. It takes HTTP traffic capturewd by mitmproxy and generates an OpenAPI…",{"value":55,"source":49,"evidence":56},"Reverse engineering apps' APIs to write alternative clients or automate tasks",[57],{"id":52,"by":11,"text":53},[59],{"value":60,"source":61,"evidence":62},"Python","inferred",[63],{"id":64,"by":65,"text":66},"31364232","olabyne","Oh, I used a python script to generate pre-made requests from HAR recently, I'm pretty sure it was your git ! Very useful :)","open_source","launched","unknown",{"praise":71,"objections":99,"requests":120,"questions":152,"alternatives":167},[72,88],{"value":73,"source":74,"evidence":75},"Clever, useful idea for documenting undocumented APIs","commenter",[76,80,84],{"id":77,"by":78,"text":79},"31359456","lancebeet","This is a really clever project. It seems like an obvious idea once you've seen it, but it clearly isn't. Thank you for sharing it.",{"id":81,"by":82,"text":83},"31362032","anitil","What a fantastic idea! I have so many half baked things that some idiot (me) built without documenting the underlying API. This will make life so much easier",{"id":85,"by":86,"text":87},"31366136","thefilmore","This is one of the most clever projects I've seen in a while. Nice work.",{"value":89,"source":74,"evidence":90},"Useful for generating docs and clients from undocumented APIs",[91,95],{"id":92,"by":93,"text":94},"31361836","julianlam","This is great work! This would come in very handy for codebases where an OpenAPI v3 spec would be welcome, but is too onerous to create by hand. Run this for a bit, have it spit…",{"id":96,"by":97,"text":98},"31359398","eligro91","Really amazing. We're having hundreds of undocumented endpoints created over the years, and running this tool on our backends will create instantly good documentation Thanks for…",[100,111],{"value":101,"source":74,"evidence":102},"Cert pinning and native SSL code can block capture",[103,107],{"id":104,"by":105,"text":106},"31360655","andreidd","That's interesting, but it won't work with native code that statically links a SSL implementation.",{"id":108,"by":109,"text":110},"31361073","jeroenhd","For Android you'll probably need root access (unless the app developer has opted in to loading your user-imported certificate authorities). For iOS this should be easier.…",{"value":112,"source":49,"evidence":113},"Schema only generated for JSON endpoints; enums hard to detect",[114,117],{"id":115,"by":11,"text":116},"31356132","It does, but it will only generate schema descriptions for JSON endpoints. Whis means that the URL and method will appear in the spec, but not the response\u002Frequest schema.",{"id":118,"by":11,"text":119},"31356327","I thought about it, but it would be hard to distinguish between an enumerator and just static data. For example if you logged in with only one account it could classify the…",[121,132,138,145],{"value":122,"source":74,"evidence":123},"Support HAR file input",[124,128],{"id":125,"by":126,"text":127},"31360854","Labo333","Very nice! On the same note, I wrote a program to generate Python code (requests) from a HAR capture: https:\u002F\u002Fgithub.com\u002Flouisabraham\u002Fhar2requests I think using HAR captures is…",{"id":129,"by":130,"text":131},"31359677","andrewstuart2","I've always wanted to build something similar to this, by reading HAR files captured right out of the devtools. Have you given any thought to that as an alternative input?",{"value":133,"source":74,"evidence":134},"Add auth detection (headers, cookies)",[135],{"id":136,"by":109,"text":137},"31356102","Very interesting! Would this also be able to determine what kind of auth (header tokens, cookies, etc) the APIs require or is that something you still need to detect manually?",{"value":139,"source":74,"evidence":140},"Option to omit OPTIONS methods",[141],{"id":142,"by":143,"text":144},"31374644","nattaylor","I gave this a try today. It was silky smooth! Is it possible to tell Swagger to omit OPTIONS methods?",{"value":146,"source":74,"evidence":147},"Browser devtools integration",[148],{"id":149,"by":150,"text":151},"31364891","POPOSYS","Can we have this as a browser dev tool please? F12 -> Tab REST -> Create spec from API",[153,160],{"value":154,"source":74,"evidence":155},"Can it capture server-rendered pages?",[156],{"id":157,"by":158,"text":159},"31355938","upupandup","does it capture route\u002Fserver rendered pages too?",{"value":161,"source":74,"evidence":162},"Does it work with pcap captures?",[163],{"id":164,"by":165,"text":166},"31357732","ducktective","Is it possible to do this on wireshark\u002Ftcpdump pcap dumps? Like for finding out hostnames, endpoints and request packets of HTTPS requests that an android app is making?",[168,172,179,186],{"value":169,"source":74,"evidence":170},"har2requests",[171],{"id":125,"by":126,"text":127},{"value":173,"source":74,"evidence":174},"apimatic transformer",[175],{"id":176,"by":177,"text":178},"31357024","efitz","OpenAPI is just the latest version of swagger. Should not be hard to change. I was able to translate HAR to OpenAPI with this web site's free preview:…",{"value":180,"source":74,"evidence":181},"APIClarity",[182],{"id":183,"by":184,"text":185},"31358553","klyr","Hi, I would also like to add another tool I'm contributing to at work (cisco) called APIClarity [1]. It aims at reconstructing swagger specifications of REST microservices…",{"value":187,"source":74,"evidence":188},"cats fuzzer",[189],{"id":190,"by":191,"text":192},"31364422","ludovicianul","This is great :) You can then fuzz your APIs for issues using https:\u002F\u002Fgithub.com\u002FEndava\u002Fcats.",{"comments":194,"answered":195,"key":196},12,10,[197,198,199],{"id":52,"text":53},{"id":115,"text":116},{"id":200,"text":201},"31356288","Totally, but you would need to do some manual cleanup and naming afterwards to make it more useful than just reading the source code. You could also for example use your…",{"commenters":203,"max_depth":204,"maker_replies":194,"first_comment_mins":205,"lifespan_hours":206},57,6,7,333,[208,210,212,213,216,219,222,225,227,228,229,230,233,235,238,242,244,247,251,253,256,258,259,260,262,265,268,272,273,276,278,279,281,283,285,289,292,294,296,298,301,302,306,309,312,316,318,320,323,325,328,330,334,336,338,340,344,346,348,349,351,354,356,358,362,365,369,372,376,378,379,381,385,389,394,396,399,403,407,410,414,418,422,426,430],[52,34,34,209,11,18],"project\u002Fpositive\u002Fidea",[157,34,43,211,158,34],"project\u002Fneutral\u002Fnone",[115,34,34,211,11,18],[214,34,44,209,215,34],"31356790","mhils",[217,34,44,209,218,34],"31357441","mohsen1",[220,34,44,209,221,34],"31359818","SOLAR_FIELDS",[223,34,43,211,224,34],"31361471","metadat",[226,34,43,211,221,34],"31361835",[77,34,44,209,78,34],[81,34,44,209,82,34],[190,34,43,211,191,34],[231,18,44,209,232,34],"31357692","nickysielicki",[104,18,18,234,105,34],"project\u002Fcritical\u002Fexecution",[236,18,34,237,109,34],"31360972","commenter\u002Fneutral\u002Fnone",[239,40,43,240,241,34],"31356256","project\u002Fneutral\u002Fidea","SemanticStrengh",[200,40,34,243,11,18],"project\u002Fneutral\u002Fdocs",[245,40,44,246,241,34],"31356313","project\u002Fpositive\u002Fdocs",[248,40,34,249,250,34],"31357498","commenter\u002Fneutral\u002Fpricing","tomatowurst",[252,40,34,249,241,34],"31357675",[254,40,34,249,255,34],"31362644","motoxpro",[257,40,34,237,250,34],"31373347",[125,43,44,209,126,34],[64,43,34,237,65,34],[261,43,34,237,126,34],"31516825",[263,43,34,264,11,18],"31397208","maker\u002Fneutral\u002Fnone",[266,43,44,267,126,34],"31516829","project\u002Fpositive\u002Fexecution",[269,270,44,209,271,34],"31356043",4,"captn3m0",[176,270,43,240,177,34],[274,270,43,211,275,34],"31357321","kaidon",[277,270,34,264,11,18],"31397213",[136,44,43,211,109,34],[280,44,34,211,11,18],"31356149",[282,204,44,209,158,34],"31355889",[284,204,34,211,11,18],"31356159",[286,204,34,287,288,34],"31361274","other\u002Fneutral\u002Fnone","ninkendo",[290,205,44,209,291,34],"31361098","aleksiy123",[293,205,43,211,191,34],"31364425",[96,295,44,209,97,34],8,[149,297,43,240,150,34],9,[299,195,43,240,300,34],"31356273","Divyeshkharade",[118,195,34,211,11,18],[303,195,44,304,305,34],"31356457","project\u002Fpositive\u002Fnone","freedomben",[307,308,44,304,177,34],"31356576",11,[310,194,34,237,311,34],"31376636","evnix",[313,314,34,287,315,34],"31355860",13,"oneweekwonder",[317,314,34,237,11,18],"31356483",[319,314,34,287,177,34],"31357098",[321,314,34,237,322,34],"31357537","flatiron",[183,324,34,287,184,34],14,[326,324,34,287,327,34],"31364555","sohaibtariq",[92,329,44,209,93,34],15,[331,332,34,287,333,34],"31360689",16,"Cilvic",[335,332,34,287,109,34],"31361035",[337,332,34,287,333,34],"31361414",[339,332,34,287,109,34],"31361805",[341,342,44,209,343,34],"31387039",17,"lsferreira42",[129,345,43,240,130,34],18,[347,345,34,240,11,18],"31397215",[164,33,43,211,165,34],[350,33,34,211,11,18],"31359400",[352,33,43,240,353,34],"31360092","resoluteteeth",[355,33,34,237,165,34],"31366124",[357,33,34,237,353,34],"31383406",[359,360,44,209,361,34],"31357953",20,"jwong_",[363,360,34,287,364,34],"31359921","john-tells-all",[366,367,44,209,368,34],"31357366",21,"chrisweekly",[370,38,44,304,371,34],"31363828","renewiltord",[373,374,43,211,375,34],"31360565",23,"dnnssl2",[108,374,43,377,109,34],"project\u002Fneutral\u002Fexecution",[142,16,44,267,143,34],[85,380,44,209,86,34],25,[382,383,44,209,384,34],"31356864",26,"dudus",[386,387,44,209,388,34],"31363252",27,"dsfiguer",[390,391,43,392,393,34],"31357586",28,"maker\u002Fneutral\u002Fexecution","instagary",[395,391,34,392,11,18],"31357664",[397,391,34,237,398,34],"31357688","paxys",[400,401,43,240,402,34],"31361770",29,"andrewstuart",[404,405,44,209,406,34],"31366700",30,"mutant",[408,32,44,304,409,34],"31370356","difu_disciple",[411,412,44,304,413,34],"31356572",32,"BWStearns",[415,416,44,209,417,34],"31359815",33,"Sytten",[419,420,43,240,421,34],"31360016",34,"a-dub",[423,424,44,209,425,34],"31356001",35,"useful",[427,428,44,304,429,34],"31365152",36,"h1fra",[431,432,44,209,433,34],"31357748",37,"mro_name",[],[436,440,445,449,454,459],{"id":437,"name":438,"points":439,"category":20},"31371340","Bud",531,{"id":441,"name":442,"points":443,"category":444},"31409077","Bike",513,"productivity",{"id":446,"name":447,"points":448,"category":20},"31364081","Aspect",479,{"id":450,"name":451,"points":452,"category":453},"31412608","Urza's AI",188,"ai",{"id":455,"name":456,"points":457,"category":458},"31364983","Fruits",185,"web_saas",{"id":460,"name":461,"points":462,"category":463},"31421232","Natural Language Processing Demystified",166,"learning_science",false,"v2",{"id":467,"name":5,"line":6,"ai":464,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":468,"top":18,"kw":469,"maker":11,"domain":10,"tier":19,"attempts":34,"strip":470,"url":9,"mix":471,"praise":73,"objection":101,"sub":21},31354130,0.59,[24,25,26,27,28],"3553551500505335553550050053305555505555",[32,33,34,18],1793991045597]