but on mobile apps? I want to spy on what api endpoint they are calling .

is there a way to monitor what API a mobile app is, calling?
|
![]()
Show posts by this member only | IPv6 | Post
#1
|
![]() ![]() ![]()
Junior Member
50 posts Joined: Apr 2022 ![]() |
|
|
||
|
![]()
Show posts by this member only | Post
#2
|
![]() ![]()
Elite
4,428 posts Joined: Jan 2003 ![]() ![]() |
|
|
![]()
Show posts by this member only | Post
#3
|
![]() ![]() ![]()
Junior Member
129 posts Joined: Aug 2005 ![]() ![]() |
QUOTE(15cm @ May 8 2022, 05:11 PM) on desktop we just click F12 and go to the network tab burp suite (paid) or zed application proxy (free).but on mobile apps? I want to spy on what api endpoint they are calling . ![]() however, nowadays there are "protections" that mobile apps can use to prevent others from studying their traffic. for better or for worse, attackers also created countermeasures to these protections: frida, etc. guides / tutorials are plenty on the net. if it's not just for fun, you should probably hire a professional to help you. or get proper (paid) training on using those tools i mentioned. |
|
![]()
Show posts by this member only | IPv6 | Post
#4
|
![]() ![]() ![]()
Junior Member
211 posts Joined: May 2011 ![]() |
Here's another idea but I don't remember the exact implementation.
I used my laptop as a proxy for my Android phone. On the laptop I run Wire Shark to monitor the network activity. This exposes the API endpoints and other nasty stuff. At least that's why I remember it anyway. |
|
![]()
Show posts by this member only | IPv6 | Post
#5
|
![]() ![]() ![]()
Junior Member
50 posts Joined: Apr 2022 ![]() |
QUOTE(silverhawk @ May 9 2022, 12:58 AM) for some reason it isnt working lolit pops a message on first launch saying it doesnt work after android 10 something something. anyway i give up i wanted to scrap a mobile app by knowing what API it uses, since its web version uses server side rendering and put all the data into an image. i'll just use ML to reverse engineer the image back into data. |
|
![]()
Show posts by this member only | Post
#6
|
![]() ![]() ![]()
Junior Member
130 posts Joined: Aug 2021 ![]() ![]() |
QUOTE(arturo_bandini @ May 9 2022, 03:08 PM) burp suite (paid) or zed application proxy (free). You may need to read the T&C before doing this.however, nowadays there are "protections" that mobile apps can use to prevent others from studying their traffic. for better or for worse, attackers also created countermeasures to these protections: frida, etc. guides / tutorials are plenty on the net. if it's not just for fun, you should probably hire a professional to help you. or get proper (paid) training on using those tools i mentioned. Testing / Finding backdoor of a product without proper invitation / authorized may have legal issue. https://github.com/venomous0x/WhatsAPI |
|
![]()
Show posts by this member only | Post
#7
|
![]() ![]() ![]()
Junior Member
50 posts Joined: Apr 2022 ![]() |
QUOTE(flashang @ May 10 2022, 12:09 PM) You may need to read the T&C before doing this. if i understand this correctly, he did what i am trying to do , intercepted the whatsapp api and is trying to create his own whatsapp app with the api ? Testing / Finding backdoor of a product without proper invitation / authorized may have legal issue. what a chad ![]() ![]() ![]() |
|
![]()
Show posts by this member only | IPv6 | Post
#8
|
![]() ![]() ![]() ![]()
Validating
483 posts Joined: Nov 2020 ![]() |
QUOTE(15cm @ May 10 2022, 06:36 PM) if i understand this correctly, he did what i am trying to do , intercepted the whatsapp api and is trying to create his own whatsapp app with the api ? If I use WhatsApp for Web, press F12 and go to Network tab, how do I know the API being called?Perhaps you can teach me... ![]() ![]() |
|
![]()
Show posts by this member only | Post
#9
|
![]() ![]() ![]()
Junior Member
50 posts Joined: Apr 2022 ![]() |
|
|
![]() |
![]() ![]() ![]()
Junior Member
50 posts Joined: Apr 2022 ![]() |
|
|
![]() |
![]() ![]() ![]() ![]() ![]() ![]() ![]()
Senior Member
1,207 posts Joined: Apr 2010 ![]() ![]() |
fiddler? charles?
|
Change to: | ![]() ![]() ![]() ![]() Time is now: 28th June 2022 - 05:31 PM |