How To: Reverse Engineer Any Private API (iOS/Android and Desktop)

In this video I demonstrate a simple step by step tutorial on how to connect to and create requests to any Private API on iOS, macOS, Android, Linux and Windows.
In other words. Hack/Reverse Engineer a Private API (Don't tell tencent plz)
Read my Blog Post: downthecrop.xy...
Fiddler: www.telerik.co...
MitM Proxy: mitmproxy.org/
Follow my socials:
/ downthecrop
/ downthecrop
downthecrop.xy...
/ downthecrop
/ downthecrop

[@downthecrop]

Tencent WeGame Statistics Project! Open Source! github.com/downthecrop/wegame-tencent-china-opgg

[@tytmisha]

Like

[@tytmisha]

wow

[@enigma7452]

Been struggling for so long on doing this, then found out about a thing called "SSL pinning" which apps are using more and more to prevent this MITM attack for API monitoring, so if you're still stuck, look into that.

[@rexintonegamers]

In Android with Xposed modules I used sll Unpinning worked for some appp u have any other method?

[@enigma7452]

@@rexintonegamers I have IOS device so i ended up jailbreaking it and then installing a tweak (SSL KILL switch) which bypasses the SSL pinning, that's what i ended up doing.

[@nuttolum]

you can decompile the app, disable ssl pinning in the code, and recompile it but its very difficult

[@methadonmanfred2787]

on android you can use a tool called apk-mitm to modify an apk and remove certificate pinning, works great on most apps

[@methadonmanfred2787]

@@nuttolum apk-mitm basically automates this process

[@the-web-scraping-guy]

Worked amazing. So easy. Super helpful video thank you

[@user-vt2sq5zf8u]

Bots

[@bobmars8771]

I LOVED this.
Thank you so much for sharing
ez sub

[@kqvanity]

Speaking of replaying the request, when I was a kid, there was this web-based game that everyone hyped over. There was two kinds of attacks, whereby the first one you'd just typically inspect element/fiddle with its memory addresses with CE the specific value on your client browser, and gold coins - or whichever resource - would max out accordingly, or go raw, and alter it server-side, with surely permanent effects. The underlying principle behind the latter was surely more intricate, but fundamentally I can speculate that - according to the semantics of the later disclosed method - it was based off replaying a precious request. Say you're about to sell a goldmine you've been pouring your time and sweat in for the past week or so, you could defer this action, fire up something like Charles at that era, isolate the game's domain, get the game in a kind of a stale state with no actions of your side, then listen for its requests, conduct the purchase, and you're good to go. Keep replaying the last action over and over nonstop. I even came up with some cursor-movement-repeating-macro kind of apps, that would just keep clicking the replay button. I remember once abusing the clicking till my Win7 cursor just started glitching non-stop, and apparently the server didn't implement a BigDecimal or smh for players' values. ;), thus my game records just overflowed with negative value.

[@mhamademad]

out of all this, i think the image caching was the most pro move.

[@evevoHD]

bro I also listened to this japanese songs playlist on youtube while reversing/programming hahah glad i am not alone

[@leonxger]

So helpful, great stuff!

[@TheJaniable]

Really useful. It's suprising to me that this is not possible on Android without rooting the phone. iOS - in this case - is more developer-friendly.

[@thesystem_bz]

Amazing! This helped!

[@scottvrosenfeld]

I'm telling! That youre da man! Thx G!

[@andredinizo]

Awesome video, thanks

[@steamsteam36]

Hey dude when I connected to proxy on my phone I don't get the wifi connection "502" problem. can you help me ?

[@dishi1951]

Anyone managed to do this for Android apps? It forks in Chrome on my phone, but no advancement on any apps (shows I'm not connected to the internet...). Installed the CA certificate as well...

[@DrewBrewsx]

yup SSL pinning is always blocking me xD

[@oakdesign4629]

I use Genymotion as Emulator burp suite as proxy and Frida for SSL unpinning. Can be setup within an hour and works like a charm for any android app I reversed engineered so far

[@yacked]

splendid video

[@hyeonoppa]

when using mitmproxy web, the client generates a token key which will expire but I need to grab it from mitmproxy itself. Is there a way to grab it using python?

[@theblackrat7350]

Most token-based applications has a request used to generate the authorization token, in some cases it can be a response of an isolated request (which you can easily emulate if you find), a response of an authorization request (generally a login request) or either a response header of a request. If your target is a mobile application, the token can be generated by some specific algorithm, in that case, you will need to decompile the app and reverse engineer the function/class responsible for generating the token, after finding it, use Frida to inject malicious code into the application during runtime to replicate the function used to generate the required token.

[@dp01452]

How to do you protect dll api?

[@the-web-scraping-guy]

Amazing thank you

[@bugs18-l5q]

what windows version

[@hrithik4515]

Can you please tell how to find ip and ip port of any game in ios? For eg pubg

[@JuniorBloxHD]

thank you!!!!

[@jasonc6241992]

How can i do this from a web server programmatically?

[@jetzeto29]

So we could still access Pokemon go API?

[@akshaykadamTalksfooty]

appguard blocks it on mitmproxy

[@hassen500]

could you ever make money or get a job in the security field? its so not in demand!

[@who_owl]

Your voice aaaaa

[@bobsanders2145]

I have TWC. It's not working for me. You think my provider is blocking it? when I go to mitm.it it shows a black screen. My firewall is off.

[@nick-pu4zae]

👌

[@AR-15K1]

I'm having a lot of problem with an apk, they gave me this for work, can someone help me and maybe earn some money?

[@drygordspellweaver8761]

Is mitm trustworthy? And what’s that workaround for android certificate? Thanks!

[@theblackrat7350]

I don't know if you're still interested in hacking or either solved your doubts already, but the solution for SSL Pinning (on android) is kinda complicated in theory, it's about reverse engineering and injecting code into the app during runtime, and bypassing functions and classes which do the certificate pinning. The hacking community already did a tool to automate that, take a look at Frida (in their docs there are a lot of bypasses for SSL Pinning, Root detection and more) and in the Xposed framework which has a collection of scripts to bypass any trouble you can encounter during a reverse engineering session.

[@drygordspellweaver8761]

@@theblackrat7350 I got it working a while back with both Frida as well as an Xposed module. Currently using burpsuite and Enigma to reverse an app API. Cheers though and thanks for your reply!

[@socialhubmarketing179]

hi there....can u help reverse engineer a android apk and devlop the api....i need to use the api to make a bot...let me knw...we can discuss the project and the charges.

[@isaacsunday1711]

Hi i can help you out

[@effortfully]

@@isaacsunday1711 how can I get in contact with you?

[@isaacsunday1711]

@@effortfully sent you a message on keybase

[@cantthinkofarandomname370]

@@isaacsunday1711 i need help too.

[@drygordspellweaver8761]

Anyone here found a way to bypass the certificate?

[@elrisitas8508]

nerd also reported

[@aibi5532]

so android is secure 😅😅

[@christcombiccombichrist2651]

I have no fucking Idea what i just watch. 😞