Video

Following this in 2024, on my iPhone the "Profile" where you install the mitmproxy has been relocated to the VPN & Device Management.

Heads up: Newest ios version needs you to go to "general", "info", "certificats... -settings" -> enable mitmproxy, as otherwise its only installed but not enabled! Otherwise (at least for me in 2024) your iphone wont be able to connect to the internet.

Is it posibble to manipulate request in middle? For example, think of an app, there is an integration of another app within it. Even if that integration in the other app receives the data from the main app, can the data be changed and sent before going to the servers of the integration app?

How complex do my projects have to be?

nah bro chill not trying at my home,instead at my friend!

Did I miss something? Why are you using your phone. What aren't you using your PC to do this?

Hack a bank app

biggest challenge for programmers regarding dating is twofold: 1) the perception that its a low status hobby/job and too nerdy and 2) finding time to practice and pursue your hobby/job while keeping your date interested with your attention and time. in my experience women almost get jealous of your focus and attention to technical things. wish they could appreciate that it just takes a lot of headspace and time

Careful, 5:20 is you coordinates..

did you put eye liner and mascara to your eyes?

Can you make a tutorial about API for beginners 🙏🏾

I got my degree in computer science about 4 years ago, and I can't even land a job at my local grocery store...

brother why did you stop posting videos? Does anyone have his social media? urgent !!! does anyone know how to find api?

it's impossible to do that on Android phones so companies are not worried so much but of course, there is a certain ways to hack them

Great video thanks

Thank you❤

What a shitty thing to do

so basically, this is not hacking

Api means fire in indonesia

Big companies that private their APIs are indeed annoying, but let's not generalize this Remember that when you take stuff from an API you're not supposed to have access to, you're essentially using the money and resources of the company behind it, without giving them anything in return. So let's avoid doing that to small companies & devs

Yeah I agree with you. Tutorials are good for basic but not as good as just doing

Bro can we hack online ludo games with reverse engineering

I totally agree, these api should have been open source to the public.

Example resume he has on your description has been deleted

How you gonna make a video like this and not provide visuals. :(

You've deleted the resume.

Can you another video explaining more about this installation

Do it for Leetcode

hi dear can you do reverse engineering api tiktok i will pay you

Can you make a private tiktok api If the answer is yes, please write your email or any other communication And I pay you Thanks

One more note: what you demonstrated would work if someone steals your phone, installs mitmproxy on it, and starts using the application in question. This will definitely expose how to API works - all its endpoints, payload structure, tokens, and perhaps some integrations with other APIs. However, if the API is designed correctly, you would only be able to get the data this one client is allowed to see (aka, the user whose phone was stolen, assuming he/she only has one app account). Of course, much of the data the API provides could be shared, in which case one user could potentially get access to 90% or more of the data, e.g. an e-commerce catalog that was considered "private" with respect to the membership implied by this app.

WIth these looks, you should be an actor, man :). But seriously, thanks for the video. Thumbs up of course.

lightskin zac efron, where’d u go??

thanks for the motivation

Wonderful video, man

API protection schemes aren't all that different from developer to developer since most APIs tend to follow a similar format when it comes to security: 1. The authorization token _(be it OAuth2, JWT, Spring, Keycloak, Passport, or Auth0)_ will likely contain information regarding what sort of access you have to the API itself. So for instance if you don't have permissions to access a certain endpoint then the resulting response can simply be an HTTP 401 _(Unauthorized)_ or even an HTTP 403 _(Forbidden)_ . *Note:* the difference between an HTTP 401 and HTTP 403 is that the HTTP 401 error is for when you provide invalid or no credentials. The HTTP 403 error is for when you lack the privileges to access the specified resource _(API endpoint in this case)_ . 2. The API server might have a rate limiter set up to limit the number of concurrent requests sent to any API endpoint within a set amount of time. This is used to prevent a single connected user from spamming the API server which uses up too many system resources for the server in question. A server that's set up to be publicly accessible will most likely have documentation on the rate limiter _(the size of the request buckets, the rate at which the request buckets are emptied, what response headers are sent whenever you are rate limited, the different types of rate limits, etc...)_ . Typically whenever we think about reverse-engineering APIs we are more-or-less thinking about something called *"fuzzing"* which can be defined as _an automated process that injects invalid, malformed, or unexpected inputs into a system to reveal defects and vulnerabilities_ . For instance if we know the URI formatting for the API server then we can simply try to find undocumented API endpoints based on common names for said endpoints. The thing about API developers taking inspiration from one-another is that sometimes they'll use similarly named endpoints for certain actions such as token invalidation, database searching, creating and deleting data, etc... If the developers didn't expect for you to find those undocumented API endpoints then maybe they also forgot to give them the same level of scrutiny when it comes to securing them versus their documented or public API endpoints. My apologies for going so deep into this topic, I am somewhat passionate about web exploitation and semantics. Good video though because it appears that so many mobile app developers don't tend to consider that a MITM could be able to intercept and manipulate API calls to exploit vulnerabilities and a ton of developers could benefit from learning this and applying it to their development process.

Hello there !! What is your instagram??

My disappointment is immeasurable. I discovered this channel through your community college internship video. So inspiring. I hope you come back

dam just found you and realized it was 3 years ago. Really enjoy your vids, should come back

you tried man

BITCONNECTTT

this is why you use cors

hello what did you use to send the request at minute 5:33 did you use burpsuite?

That was great.. How much per hour for a personal tutoring?

How can I connect with you bro

Great video 🤘🔥🔥🔥

Awesome video 😎

2022 any girl here am 20

wait these videos were fire

Sorry, but you can’t MITM yourself lmao. Is this a joke?