Hacking/Reverse Engineering a PRIVATE api

Hacking/Reverse Engineering a PRIVATE api
Yo guys, today I wanted to get some data from a private api, so I went ahead and did some hacking/reverse engineering to get the data from this private api.
Hacking isn't always a bad thing, and if you want to call it reverse engineering to make yourself feel better, be my guest. So today we are hacking/reverse engineering a PRIVATE api.
We ended up getting the data from the private api and that is all that matters. I do not endorse hacking/reverse engineering of any Private api's, but do what you need to do.
ALL MY THOUGHTS ARE MY OWN
reverse engineering and hacking are just a part of the technology and software engineering industry.
This type of video was inspired by Devon Crawford. Definitely one of the better CS youtubers. Devon Crawford inspired me to make better videos with his "Hacking the KZbin Algorithm 2019" video. Devon Crawford, keep making great videos.
Alright let's get to the hacking/reverse engineering a PRIVATE api.
Here is the "hacking the youtube algorithm 2019" video by Devon Crawford: • Hacking the KZbin Al...
*IF YOU ENJOYED THIS VIDEO AND YOU'RE FEELING LIKE HULK, SMASH THAT LIKE BUTTON AND SUBSCRIBE TO NEVER MISS ANY CONTENT*
#HackingAnAPI
#ReverseEngineeringAnAPI
#DevonCrawford

[@chriscodes2085]

What other projects do you guys want to see made?

[@duckity4320]

Reverse a roblox exploit api and dm the api in discord C;#5561 its calls synapse the website x.synapse.to

[@TimsDaBossMC]

make a proxy for your iphone that blocks ads from youtube and spotify bonus points if you get vrv and crunchyroll. ive tried and fiddled around with similar mitm sniffing but gave up too early cuz never read any documentation or bothered to learn the fundamentals of networking

[@مشعلالعنزي-ذ5ل6ط]

bro you have twitter account?

[@vigneshkumar2778]

How to predict api result of live running website which has timestamp Its result is updating every 3 mins Can i have the result before the actual result time..?

[@JoeSrebernak]

Will you do an app that requires login credentials to access the app and a passcode to perform an action? No 2FA.

[@aydryos7847]

API protection schemes aren't all that different from developer to developer since most APIs tend to follow a similar format when it comes to security: 1. The authorization token _(be it OAuth2, JWT, Spring, Keycloak, Passport, or Auth0)_ will likely contain information regarding what sort of access you have to the API itself. So for instance if you don't have permissions to access a certain endpoint then the resulting response can simply be an HTTP 401 _(Unauthorized)_ or even an HTTP 403 _(Forbidden)_ . *Note:* the difference between an HTTP 401 and HTTP 403 is that the HTTP 401 error is for when you provide invalid or no credentials. The HTTP 403 error is for when you lack the privileges to access the specified resource _(API endpoint in this case)_ . 2. The API server might have a rate limiter set up to limit the number of concurrent requests sent to any API endpoint within a set amount of time. This is used to prevent a single connected user from spamming the API server which uses up too many system resources for the server in question. A server that's set up to be publicly accessible will most likely have documentation on the rate limiter _(the size of the request buckets, the rate at which the request buckets are emptied, what response headers are sent whenever you are rate limited, the different types of rate limits, etc...)_ . Typically whenever we think about reverse-engineering APIs we are more-or-less thinking about something called *"fuzzing"* which can be defined as _an automated process that injects invalid, malformed, or unexpected inputs into a system to reveal defects and vulnerabilities_ . For instance if we know the URI formatting for the API server then we can simply try to find undocumented API endpoints based on common names for said endpoints. The thing about API developers taking inspiration from one-another is that sometimes they'll use similarly named endpoints for certain actions such as token invalidation, database searching, creating and deleting data, etc... If the developers didn't expect for you to find those undocumented API endpoints then maybe they also forgot to give them the same level of scrutiny when it comes to securing them versus their documented or public API endpoints. My apologies for going so deep into this topic, I am somewhat passionate about web exploitation and semantics. Good video though because it appears that so many mobile app developers don't tend to consider that a MITM could be able to intercept and manipulate API calls to exploit vulnerabilities and a ton of developers could benefit from learning this and applying it to their development process.

[@krumpy8259]

The first time that I wanted a comment to be longer, thank you it‘s such a concise and useful read. Where are you learning from or do you teach?

[@BronkoBanane]

this guy knows his stuff.

[@Blackincolor]

thank you for your comment

[@herveyachar1071]

API is like a bridge linking one point to another using a specific language query that it understands which is in the server of the provider stored for the client on client server

[@jlambert12013]

liked & subscribed

[@CyrisCloete]

It's such a rush when you gain access to things like this, great work. Think I'm going to have a lot of fun with mitmproxy. Subscribed.

[@chriscodes2085]

+Cyris Cloete thanks brother!

[@divineerhomonsele8545]

Nice video. This really got me thinking about my api😂

[@MateusPikao]

Hey dude, good job with the video. You can also use the proxy to find out the endpoint used by your phone in order to get the access token, so you are going to be able to log in from your computer and get new access tokens ( Because they probably have a TTL). Another tip is to check if the app has also a website because if they have they are probably using the same private API, so u don't even need to proxy your phone.

[@CaramelFur]

Luckily it was this easy for this app, some apps implement certificate pinning, so even after you install your own certificate it just ignores it and doesnt accept the mitm requests.

[@strik3r137]

hmm..not really hacking if using the public request string with a valid user token.... get restricted user data from other user without token would be hacking...

[@awfhaiuhiafiadhdifhadidai6197]

exactly

[@georgesmith9178]

One more note: what you demonstrated would work if someone steals your phone, installs mitmproxy on it, and starts using the application in question. This will definitely expose how to API works - all its endpoints, payload structure, tokens, and perhaps some integrations with other APIs. However, if the API is designed correctly, you would only be able to get the data this one client is allowed to see (aka, the user whose phone was stolen, assuming he/she only has one app account). Of course, much of the data the API provides could be shared, in which case one user could potentially get access to 90% or more of the data, e.g. an e-commerce catalog that was considered "private" with respect to the membership implied by this app.

[@RedStoneMatt]

Big companies that private their APIs are indeed annoying, but let's not generalize this Remember that when you take stuff from an API you're not supposed to have access to, you're essentially using the money and resources of the company behind it, without giving them anything in return. So let's avoid doing that to small companies & devs

[@zubairrao6912]

So guys if you don't understand what he actually did is he intercepted his request from phone app into the his pc using mitmproxy and then he used access_token value to get the results without using the app and he got succeeded

[@youtuse007]

So what you actually did was get JSON response with the data you already have in your phone?

[@crysiscontained4421]

Yes that's what he did, what he doesn't know is that token expires and without the ability to reverse engineer how that access token is generated he will have to do the same thing again once it does. The token is probably generated using a random string algorithm which is damn near impossible to predict. These types of web tokens don't carry any information like the olden days of the JWT tokens did. Their api is safe for another day. Can't decode it cause there's no hash so nothing to decode. What he needs is the mathematical algorithm they used to generate the token to begin with, that's what they are keeping safe. It's even harder to do with a login version since that token would be tied to your credentials in /their/ db.

[@maximiliandmc]

@@crysiscontained4421 JWT tokens still do and will always carry public information... and the whole purpose of the JWT is for the API to be stateless so the token doesnt need to be stored on any DB. Some implementations do save the tokens tho but its not recommended, there are other ways to go around that problem.

[@miguelfrosales01]

Intercept the authentication call to be able to generate tokens. In oauth2 a token is usually valid around 2 min depending on what was set by admins

[@crysiscontained4421]

Auth calls don't carry any information, it's just a GET request with a couple headers and a cookie gen client-side, and oauth is a lot longer than that usually. I have used an oauth token for over 24 hours on most sites, shortest I have seen is 6 hours. token gens are done completely server-side and don't get sent over HTTP/S requests.

[@maximiliandmc]

@@crysiscontained4421 What he is trying to say is that you can intercept oauth refresh token which is commonly used to generate new access tokens. And when you say "token gens" you're referring to the private key. Private keys may not get sent over http but refresh tokens and access tokens surely do.

[@miftahulfaris4400]

Next video: Bypass ssl pinning.

[@brimmed]

is that possible? i've been playing around with man in the middle for last few months and ran into this issue with ssl pinning the other day

[@IRLTools]

@@brimmed Yes, Frida + hooking to specific functions.

[@lollopin3362]

Ssl kill switch 2

[@obywonimaccheroni-5750]

@@brimmed use android, root it, install xposed framework, install SSLUnpinning module, now with SSlunpinning module you can select witch app u want to unpin. note: on well made apps like instagram or facebook this method doesen't work, in this case you need to sear a modded apk

[@maskahleo]

@@obywonimaccheroni-5750 can I do this with an emulator or need an actual device

[@treskmod]

This is amazing! Companies really need to start caring about their APIs

[@chriscodes2085]

+Govind Prasanth thanks brother, and I know. Just open source the API and people will work on it and make it better for FREE! I don’t get it. It’s greedy

[@tobinbourne8939]

F12 ... Companies steal all the time.

[@jgdublin]

Hey Chris, Thanks for making this video. I don't know much about api but I think this can help me with a project I'm working on. Good luck with your channel.

[@VivoY-nq5lm]

///.####&64%//3nkwwww

[@georgesmith9178]

WIth these looks, you should be an actor, man :). But seriously, thanks for the video. Thumbs up of course.

[@helpmenow22]

I totally agree, these api should have been open source to the public.

[@bertrandfossung1216]

Thanks Chris..you blew me away with this video. Please I need to see another video on Hacking DNS and cloud servers

[@bukankapi4014]

such a clean and top notch video ! earn my sub in the first 10 sec , thanks for sharing dude

[@JKPHoldings]

Well done.. I was wondering how my coder was doing it. WE are using the exact process to set up a multiple API. Well done breaking it down!

[@khalifarmili1256]

This guy is a Noob. You could simply use a short expiry time and that key becomes useless. If these guys wanted to protect their api he couldnt have seen that key unless he logged in.

[@redfolgers2233]

@@khalifarmili1256 so users have to log in every minute with your short expiry time? who wants to use an app that constantly wants you to log back in all the time dude

[@DroneKingsInDarwin]

Think I need to watch this a few times to follow what you did. Very interesting.

[@chriscodes2085]

Drone Kings in Darwin thanks for the comment brother!

[@devinddst7467]

The reason they are private is to release stress on the api's..

[@szymonrykaa8987]

it isn't an issue, it's normal behavior of API's. The problem would exists if You could access resources, which weren't destined to You.

[@meetkumarmarakana3365]

Superb 👍 . The way you explained the stuff was very easy to understand. Keep it up bro 👍 👍 👍

[@LTTheReal]

Following this in 2024, on my iPhone the "Profile" where you install the mitmproxy has been relocated to the VPN & Device Management.

[@simont936]

Security (access codes) are often not important from an ISV's point of view. APIs are often "private" not because of any security concern but so that the ISV can change THEIR OWN APIs without needing backward compatibility and so on. They're not private for commercial reasons but technical ones. So, of course, if you write your app against private APIs then don't complain if they break in the next version. Public APIs require far greater support. By all means use private APIs, but why not also contact the ISV and ask them to make their API public? Or even (here's an idea) pay them to use their software, in the form of a support contract...

[@simont936]

Let me get this straight: Security is a HUGE concern, but in your example, you ALREADY HAD THE ACCESS CODES, you ALREADY HAD THE KEY. So, that is entirely irrelevant that the API uses that key.... what you were arguing is to make private APIs public, and implying that they are private as some kind of security-through-obscurity, when that is not really the intent most of the time. As soon as you publish an API you have all sorts of forward and backward compatibility problems that are mitigated by having private, unsupported APIs. If you want the API to be supported, pay to support it.

[@seanworkman6523]

Can anyone here help me identify my ex-girlfriend as my cyberstalker so I can put a stop the constant harassment??? She works in law enforcement and is abusing the resources available to her to harassment and anyone connected to me. This has been going on for 4 years now... PLEASE HELP ME BRING HER DOWN! I have no problem paying a fair price $$$ for SOLUTION BASED help!

[@worlds22]

@@mikechickenman Exactly, it is absurd to me people watch this and be impressed. This dude already has access to the API, he even has an api key to use. He just gained control over something he already had control over, how impressive lol.

[@tilter4058]

Is it posibble to manipulate request in middle? For example, think of an app, there is an integration of another app within it. Even if that integration in the other app receives the data from the main app, can the data be changed and sent before going to the servers of the integration app?

[@mez3226]

Thanks so much! This was a really, really, really big help!

[@NobleSpartansTeam]

You straight look like Jesse Williams lmao. Besides that, nice job very interesting video!

[@eliaspfeffer]

Heads up: Newest ios version needs you to go to "general", "info", "certificats... -settings" -> enable mitmproxy, as otherwise its only installed but not enabled! Otherwise (at least for me in 2024) your iphone wont be able to connect to the internet.

[@Edytzu2o]

nah bro chill not trying at my home,instead at my friend!

[@mcspraint4591]

this is why you use cors

[@sonerabay7296]

I thought that it's pretty standart that you think someone will try to use your API's. That's why you put a rate limit per authenticated users. Son a single user gets only x amount of request where they can't serve the API to 100s of people.

[@gamestructure5525]

bruh u killed this video i had to rewatch video too lit !!

[@morrisroberti612]

Wonderful video, man

[@Chris_t0]

Bit lame without figuring out the hashing

[@xw591]

I'm just gonna pretend I understood

[@TechnoXeroz]

@Paul : I know this is a little late but I'd suggest looking at kzbin.info/www/bejne/eKm5YmeeZdB5qZI by Tom Scott

[@renakunisaki]

Cool coordinates.

[@ShivamSharma-xz5je]

Man in the Middle 101

[@user-blackeagle]

did you put eye liner and mascara to your eyes?

[@tonyvalentine3712]

3:24 how you get the access token without the credentials. Are you using Postman for the POST req? 5:09 like I’m confused on how you got the access token, this is like magic. Like how Sway???

[@ashishsajwan9]

For that only he had created a proxy...which logs all the data flowing through it.

[@zer0six472]

Great video 🤘🔥🔥🔥

[@ReversingHub]

pretty cool, engaging work. thumbs up!

[@oktayozkan2256]

so basically, this is not hacking

[@LiEnby]

This is reverse engineering .

[@prasenjitgautam]

Only 1.1k subscribers? You need more bro

[@kaiherron1906]

he pulled a devon crawford

[@michelglimlip4234]

bro i want api of a web based parser called a-parser coz i develop one my own but it has cloudflare is that matter , that the website has cloudflare with this method?? thanksss

[@fkbey5756]

As a result, do u recommend to developers to secure the api with Oauth2 ?

[@crysiscontained4421]

You'll get the same result with oauth the token itself is not important. the token expires, the gen method is what is important he talks about hashing but web tokens aren't hashed anymore as they carry no data. What he is likely referring to is the old JWT tokens which were hashed because they carried important info in them these new tokens use a random string gen so you can't decode them, you need the algorithm that was used to generate them. in fact you don't even need to do a MITM attack to get your token just open the developer inspect tool on your browser go to application tab and click on cookie, your auth token is in there

[@abdullahawad385]

it's impossible to do that on Android phones so companies are not worried so much but of course, there is a certain ways to hack them

[@LiEnby]

Funny and naive

[@abdullahawad385]

​@@LiEnby Yep you're right. I was naive at that time and actually it's fairly easy to do on android

[@futurotechmindset]

brother why did you stop posting videos? Does anyone have his social media? urgent !!! does anyone know how to find api?

[@libyanpro9621]

Thank's chriscodes keep up the good work ^_^

[@chriscodes2085]

+Malik Dernawi thanks brother!

[@gilsonmiranda8372]

How would you generate fake api Key when you already have a demo Key? is It posible to reverse Engineer a Key?

[@fantasticwriter735]

That was great.. How much per hour for a personal tutoring?

[@EnglishRain]

Awesome video!

[@jasonc6241992]

Holy crap I was looking for a way to find the person that hacked my gmail and i find this gem for my personal project

[@mohdsajidshaikh4291]

How to protect own api on server from apps like packet tracers on android. My users catches data and make from postman. Any help on this

[@hermes5456]

I don't even know how i manage to understand all that.

[@r00tbotnet42]

hello what did you use to send the request at minute 5:33 did you use burpsuite?

[@rrittenhouse]

Uh didn't you dox yourself on this one? I'm seeing coords that lead to a house. Might wanna look into that.

[@drygordspellweaver8761]

Respect the hustle

[@cooldharan]

I have a doubt. I use a website and I know their http requests and response. Anyone can access their site. Can I use the requests in my app without telling them or just provide credits to their website?

[@laughing_boothcodm349]

Can you make a tutorial about API for beginners 🙏🏾

[@juleswinnfield1437]

Great video :)

[@didyouknowamazingfacts2790]

Did I miss something? Why are you using your phone. What aren't you using your PC to do this?

[@LiEnby]

Because the app runs on his phone.

[@didyouknowamazingfacts2790]

@@LiEnby Yes, but the website is an app also.

[@tilter4058]

@@didyouknowamazingfacts2790 Maybe the app doesn't have a website?

[@johndoe-dx3sl]

this is not exactly private, a private api should have a signature then you would need to work on their algo, which requires reversing their app. lol

[@tdmiles1]

that was awesome!!!

[@kangaroozach]

Can you use this method to post data to their server?

[@jamieblaze6514]

Well looks like i won't be using rest API's lol... what about gRPC? is that easy to hack?

[@swiz747]

terrible idea not scrubbing that geo location data

[@atanunayak8340]

Do it for Leetcode

[@rafifmulia1193]

but only debug app and web will be intercepted, when i open random apk what i've install from play store then mitm proxy doesn't work to intercept the request and the app return error ssl bla bla bla(ca-certificate had been installed), or infinite loading

[@-_--vs1ku]

you need to bypass ssl pining

[@gbeck1065]

you could do that with post man also. it have a tool for reverse engeneer an api

[@gorgeuos]

did you manage to get it to work?

[@gbeck1065]

yes I did. you have to download the chrome pluging. I actualy dont remember how it works. I did that a long time ago. But what i can say is that i had a hard time with that because they dont have the tutorials on their site updated but you can also find tutorials from other ppl in the web. Once you do it once, it will look easyer to repeat.

[@efrainlarios5951]

Can you another video explaining more about this installation

[@alex59292]

There's a medium post

[@shekharchander593]

Hey, I'm not able to capture https requests.

[@malekguedda235]

thxxx it's amazing, but why do keep telling us not to try it, is it illegal ? i need to make an app that uses some banks data but their apis are private, is it legal or not to get them like this because i don't wanna get in troubles honestly

[@GadgetPulseShorts]

pretty sure its illegal

[@AmCanTech]

Reverse engineer an android app.

[@kezin395]

Yeh

[@raj17774]

What's the benefit?

[@Adam-gd6ok]

This is quite simple depending on what you want to do.

[@DonnyKurniawanisok]

Api means fire in indonesia

[@camn-bv3vq]

Scrapping pls. Now big companies are investing on anti-scrapping methods

[@hexay4321]

Careful, 5:20 is you coordinates..

[@alexruedi1995]

Reverse Engineering an API? You just used a simple proxy. Where is the hacking? Do you talk about using a valid access token? They probably hacked you by making you visit their page, would be awesome to hide some object prototype security 'flaws' within a reverse proxy. Did you install nodejs as admin? Good luck with security if you don't have the basic knowledge..

[@愛聖-e8w]

I don't really get your point... you are right that what he did was basically using a proxy that is able to show him all the packets sent and received, but what else would you call reverse engineering API?

[@ipodtouch470]

Why would he need to hack at all? All he needed was to find out the endpoints of the api in question and how the response was set back so he can properly parse the data. From what I have seen in the comments though his token is temporary and he hasn't found out how to produce one. So once it expires he will have to do this again to find out a new token.

[@LiEnby]

​@@ipodtouch470That is infact "hacking"

[@abderrahimelgomri1626]

what a shame they are not using ssl pinning

[@LiEnby]

Literally pointless 😭

[@geraldnjakai5471]

Hack a bank app

[@forester1]

Is it possible to hack firebase database ? Can we delete or change all firebase data of a android application

[@VivoY-nq5lm]

now dan im not deletd folow mw

[@LukeAvedon]

NICE

[@donburgerss5375]

Wtf you look like the android from Detroit become human

[@yassine5771]

Can you this for Snapchat app?

[@petertemple3067]

How can I connect with you bro

[@IndicaEnjoyer420]

do you put eyeliner

[@MultiFRAFER]

Use burosuite

[@GoodBoyDanny]

BRO THANK YOU

[@GoodBoyDanny]

no like actually thank you

[@GoodBoyDanny]

legend

[@nullpwn]

[@latwn2518]

hi dear can you do reverse engineering api tiktok i will pay you

[@PodcastPeek007]

u could have just used burp

[@amyqb117]

I actually prefer this

[@chrischoir3594]

Can't you just use chrome to intercept?

[@SheIITear]

Umm, on a mobile app?

[@md.rifathossain5991]

how can contact with YOU

[@mohagames4715]

they will catch you you posted it hhh

[@godgamer4767]

Mac os is super good as compared window 🔥🔥🔥

[@hassaannoor]

You look like John Cena

[@kadahshajay84]

This is basically Session hijacking right?!!!

[@TimsDaBossMC]

if the api key expires in a given time (session) then yes but otherwise not really it's just bad programming by the company lol

[@Funnyvideosfunny212]

Bro can we hack online ludo games with reverse engineering