{"id":317,"date":"2017-06-07T12:06:30","date_gmt":"2017-06-07T11:06:30","guid":{"rendered":"http:\/\/www.jacquescortes.fr\/blog\/?p=317"},"modified":"2017-06-07T12:10:14","modified_gmt":"2017-06-07T11:10:14","slug":"api-privee-applications-mobiles","status":"publish","type":"post","link":"http:\/\/www.jacquescortes.fr\/blog\/2017\/06\/api-privee-applications-mobiles\/","title":{"rendered":"Et si on profitait de l&rsquo;API priv\u00e9e des applications mobiles?"},"content":{"rendered":"<p>Voici un article fort int\u00e9ressant sur comment exploiter l&rsquo;API d&rsquo;une application mobile :<\/p>\n<p><a href=\"https:\/\/medium.com\/@paco.villetard\/comment-exploiter-lapi-priv%C3%A9e-d-une-application-mobile-ea218d890d71\">https:\/\/medium.com\/@paco.villetard\/comment-exploiter-lapi-priv%C3%A9e-d-une-application-mobile-ea218d890d71<\/a><\/p>\n<p>Ecrit par un growth hacker, il nous explique comment mettre en place un proxy entre l&rsquo;application mobile et son backend afin d&rsquo;\u00e9couter les \u00e9changes et d&rsquo;en tirer parti par la suite.<br \/>\nLe besoin au d\u00e9part est de vouloir scraper les datas d&rsquo;un site web. Ce site web poss\u00e9dant une application mobile, le growth hacker souhaite passer par l&rsquo;API priv\u00e9 pour r\u00e9cup\u00e9rer du json ou du xml pour se faciliter la tache.<\/p>\n<p>Ce qui est int\u00e9ressant du point de vue du d\u00e9veloppeur d&rsquo;API backend, c&rsquo;est la technique pour visualiser les \u00e9changes et d\u00e9boguer.<br \/>\nC&rsquo;est aussi int\u00e9ressant de voir la simplicit\u00e9 de se faire espionner son API m\u00eame si les \u00e9changes sont en HTTPS.<\/p>\n<p>En petit r\u00e9sum\u00e9 :<\/p>\n<ul>\n<li>Mettre en place le proxy : T\u00e9l\u00e9chargez et installez la derni\u00e8re version de Burp Suite\u00a0: <a class=\"markup--anchor markup--p-anchor\" href=\"https:\/\/portswigger.net\/burp\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-href=\"https:\/\/portswigger.net\/burp\/\">https:\/\/portswigger.net\/burp\/<\/a><\/li>\n<li>Configurer le wifi sur le t\u00e9l\u00e9phone pour qu&rsquo;il passe par le proxy<\/li>\n<li>Importer dans le mobile l\u2019autorit\u00e9 de certification (CA) du proxy\n<ul>\n<li><a class=\"markup--anchor markup--p-anchor\" href=\"https:\/\/support.portswigger.net\/customer\/en\/portal\/articles\/1841102-installing-burp-s-ca-certificate-in-an-android-device\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-href=\"https:\/\/support.portswigger.net\/customer\/en\/portal\/articles\/1841102-installing-burp-s-ca-certificate-in-an-android-device\">Installation du CA sur Android<\/a><\/li>\n<li><a class=\"markup--anchor markup--p-anchor\" href=\"https:\/\/support.portswigger.net\/customer\/en\/portal\/articles\/1841109-installing-burp-s-ca-certificate-in-an-ios-device\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-href=\"https:\/\/support.portswigger.net\/customer\/en\/portal\/articles\/1841109-installing-burp-s-ca-certificate-in-an-ios-device\">Installation du CA sur iOS<\/a><\/li>\n<li><a class=\"markup--anchor markup--p-anchor\" href=\"https:\/\/support.portswigger.net\/customer\/en\/portal\/articles\/1841111-installing-burp-s-ca-certificate-in-a-windows-mobile-device\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-href=\"https:\/\/support.portswigger.net\/customer\/en\/portal\/articles\/1841111-installing-burp-s-ca-certificate-in-a-windows-mobile-device\">Installation du CA sur Windows Device<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><a href=\"http:\/\/www.jacquescortes.fr\/blog\/2017\/06\/on-profitait-de-lapi-privee-applications-mobiles\/portswigger-logo\/\" rel=\"attachment wp-att-320\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-320\" src=\"http:\/\/www.jacquescortes.fr\/blog\/wp-content\/uploads\/2017\/06\/portswigger-logo.png\" alt=\"\" width=\"800\" height=\"170\" srcset=\"http:\/\/www.jacquescortes.fr\/blog\/wp-content\/uploads\/2017\/06\/portswigger-logo.png 800w, http:\/\/www.jacquescortes.fr\/blog\/wp-content\/uploads\/2017\/06\/portswigger-logo-300x64.png 300w, http:\/\/www.jacquescortes.fr\/blog\/wp-content\/uploads\/2017\/06\/portswigger-logo-768x163.png 768w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/a><\/p>\n<p>C&rsquo;est tout! Trop facile.<br \/>\nAmusant aussi, intercepter et modifier les requ\u00eates \u00e0 la vol\u00e9 pour \u00ab\u00a0tricher\u00a0\u00bb&#8230;<br \/>\nCa ouvre des perspectives pour un pirate&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Voici un article fort int\u00e9ressant sur comment exploiter l&rsquo;API d&rsquo;une application mobile : https:\/\/medium.com\/@paco.villetard\/comment-exploiter-lapi-priv%C3%A9e-d-une-application-mobile-ea218d890d71 Ecrit par un growth hacker, il nous explique comment mettre en place un proxy entre l&rsquo;application mobile et son backend afin d&rsquo;\u00e9couter les \u00e9changes et d&rsquo;en tirer parti par la suite. Le besoin au d\u00e9part est de vouloir scraper les datas [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":320,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,10,19,20],"tags":[],"series":[],"class_list":{"0":"post-317","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-api","8":"category-mobile","9":"category-growth-hacking","10":"category-scraping","11":"czr-hentry"},"_links":{"self":[{"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/posts\/317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/comments?post=317"}],"version-history":[{"count":4,"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/posts\/317\/revisions"}],"predecessor-version":[{"id":323,"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/posts\/317\/revisions\/323"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/media\/320"}],"wp:attachment":[{"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/media?parent=317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/categories?post=317"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/tags?post=317"},{"taxonomy":"series","embeddable":true,"href":"http:\/\/www.jacquescortes.fr\/blog\/wp-json\/wp\/v2\/series?post=317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}