Hacker News Reader

Awesome!

I tried writing a CLI tool for ordering Chipotle, but I ran into some dynamically generated headers, that made it near impossible to authenticate. In the end, I gave up.

Would love to see more examples and see how issues like this can be handled!

View on HN

I’ve had this come up a few times when doing API snooping, and what I’ve done is decompiling the Android version (if available) of their app using jadx [1]. You get pretty legible Java, sometimes with Kotlin artifacts, sometimes with obfuscation, but in combination with some MITM snooping you can see how auth/headers/hashes are done. Sometimes you even find internal API endpoints with a security issue or two.

[1]: https://github.com/skylot/jadx

Thanks!

I've used jadx once before to decompile a steamship line app, but it was just curiosity with no end goal in mind. Didn't try it with the chipotle app.

Next project!

Reply on news.ycombinator.com