zlacker

This is what I would usually do as well, self-MiTM and analyze the traffic, reverse engineer from there.

>>hultne+(OP)
While if possible, it's the best course of action, the truth is these days additions like HSTS make it extremely difficult to MITM.

Additionally, MITM and trying things out on a toaster are one thing, doing the same on a 40k$ machine that can potentially make it impossible to do your commute is another.

This is IMO a prime example where the double team rev eng is key to success: one documents the API, the other uses it without having access to code (whiteroom)

>>aneutr+Id
Nitpick: HSTS doesn't interfere with MITM. You're thinking of certificate pinning.

>>amelia+iU
You are right, I was thinking of stapling but wrote HSTS. Thanks

>>amelia+iU
HSTS interferes with MITM when the mobile device in question doesn't allow you to install new certificate authorities (as is slowly becoming the case).