MitmProxy2Swagger: Automagically reverse-engineer REST APIs (github.com)

Article summary

MitmProxy2Swagger is a tool that automatically converts mitmproxy captures to OpenAPI 3.0 specifications, allowing users to reverse-engineer REST APIs by capturing traffic. The tool can process HAR files exported from browser DevTools and generates endpoint descriptions. It requires users to edit the schema file to remove the 'ignore:' prefix from the paths they wish to generate. The tool can also add example data to requests and responses, but this may add sensitive data to the schema.

Main themes

• API reverse engineering
• Mitmproxy
• OpenAPI 3.0
• REST API
• Traffic capture
• API documentation

What commenters say

• The tool is useful for reverse-engineering APIs, especially for legacy systems that lack proper API documentation.
• Some users have successfully used the tool to reverse-engineer APIs, including those with aggressive security measures like CAPTCHAs and device fingerprinting.
• The tool may not work well with GraphQL APIs, which can be more complex and require additional tooling to stitch together schema files.
• Adding authentication to an API can prevent unauthorized use, but some apps may not implement this due to laziness or skill issues.
• The tool can be used to generate API documentation, but it may not always produce perfect results, especially with non-RESTful APIs.
• Some users have found the tool to be helpful in accelerating their work, but it may not detect all endpoints or parameters correctly.
• The use of mitmproxy and similar tools can be blocked by certain security measures, such as certificate pinning, but there are workarounds available.
• The tool's ability to add example data to requests and responses can be useful, but it also raises concerns about sensitive data being added to the schema.