Reverse Engineering a Web API
summary
Reverse engineering a private web API here means capturing real traffic with DevTools exports and a HAR file, or intercepting multi-device streams via a proxy like Postman Interceptor (or Fiddler/Burp), importing into Postman, then replaying requests. Examples show surprises: a TikTok session fires 50+ requests in eight seconds; cookie sync and curl-to-Postman import return 200s out of the box, but replay breaks on expiring tokens, signed headers and server-side checks. Practical work involves scripting cookie/session reuse and generating code snippets to automate retries.
AI-written summary · about
chapters (14)
- 0:00Introduction and setup
- 1:09What is reverse engineering an API
- 3:59Why reverse engineer APIs
- 6:30Legal and ethical considerations
- 8:55Tools for capturing network traffic
- 12:09Using web proxies for traffic capture
- 16:06Proxying mobile and other client traffic
- 17:31Replaying and testing captured APIs
- 18:34Handling authentication and session tokens
- 19:17Cookie-based authentication
- 22:26Spoofing client attributes
- 24:55Replaying calls programmatically
- 25:59Key takeaways and challenges
- 27:02Postman features and updates
related talks
27mReverse Engineering a Private API
25mHow Do They Get In?! Understanding the API Attack Vector
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
35mHow to Break API's
25mHack-Proof Your API: Exclusive Attack Simulator Deep Dive 🛡️
01h 33mScraping and reverse engineering the right way
53mHacking And Defending APIs: Red And Blue Make Purple
27mReverse-engineering JavaScript to get rid of trust issues