How to get access to *private* backend API? (non-malicious)

1

Tracker.GG

#Gaming #Gaming Stats #Online Games 770 social mentions

2

mitmproxy

You can packet-sniff your own computer to watch the game communicate with the server, and begin to reverse-engineer the undocumented API by watching the interaction. Assuming the connection is encrypted (and why wouldn't it be, in this day and age), you'll probably have to run something like mitmproxy to decrypt the connection. If they're using certificate pinning, or connect using something other than HTTPS, you may have to reverse engineer the application directly, reading the strings or stepping through instructions to see what calls it makes. Doable, but complicated and tedious.

#Developer Tools #Security #Software Development 81 social mentions