Reverse Engineering a Private API
summary
Live demo captures 30–40 TikTok backend calls with Chrome DevTools, saves sessions as HAR file import, streams traffic through a local proxy (Postman Interceptor or Burp/Fiddler), then imports individual requests via copy as curl into Postman. Replays require handling cookie-based auth and rotating tokens; one solution is syncing browser cookies into Postman. Spoofing headers like user-agent spoofing (e.g., googlebot) forces servers to return dynamically rendered HTML. Examples include Papa John’s extra-bacon bug and a Yosemite campsite booking script.
AI-written summary · about
chapters (9)
- 0:00Introduction and Use Cases
- 2:33Why Reverse Engineer APIs
- 6:09Legal and Ethical Guidelines
- 7:15Capturing Network Requests
- 9:08Capturing Session Traffic
- 11:04Using Web Proxies
- 17:14Replaying API Calls
- 20:54Spoofing and Client Secrets
- 23:57Conclusion and Key Takeaways
related talks
27mReverse Engineering a Web API
24mUsing Chrome Developer Tools to hack your way into concerts
01h 33mScraping and reverse engineering the right way
27mReverse-engineering JavaScript to get rid of trust issues
25mHack-Proof Your API: Exclusive Attack Simulator Deep Dive 🛡️
35mHow to Break API's
40mGet Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations
19mLive Hacking Session Part 1