reverse-engineer

Reverse Engineering

When the data isn't in the HTML, it's in an API. When the API isn't public, it's hidden in the JavaScript. When the JavaScript is obfuscated, the keys are still in the page source — because the browser needs them to decrypt, which means you can too.

This skill is an escalation ladder. Start at Level 1 and stop as soon as you have what you need.

Escalation ladder

  Level 1   📡  Network capture          watch DevTools, find the API call
  Level 2   🔬  Response classification  Shannon entropy — plaintext vs compressed vs encrypted
  Level 3   🔁  API replay               copy as cURL, replay with fetch, 403 bypass tricks
  Level 4   🔑  Token extraction         find auth tokens, CSRF, API keys in page source
  Level 5   📦  JS deobfuscation         unpack webpack, deobfuscate, read the source
  Level 6   🔐  Payload decryption       NaCl / AES-GCM / CryptoJS — extract keys, decrypt
  Level 7   🔌  WebSocket interception    establish WS, subscribe to channels, decode frames
  Level 8   🔮  GraphQL reconstruction    extract queries from JS, force PersistedQueryNotFound
  Level 9   🧬  Protobuf decoding        reverse-engineer .proto schema from binary blobs

Level 1 — Network capture

When: Phase 0 curl returns HTML with no target data. The data loads via XHR/fetch after JS runs.

Open the page in the real Chrome debug port, capture every API call during page load:

const page = await browser.newPage();

const apiCalls = [];
page.on("response", async (res) => {
  const url = res.url();
  const ct = res.headers()["content-type"] || "";
  if (
    ct.includes("json") || ct.includes("grpc") || ct.includes("protobuf") ||
    url.includes("/api/") || url.includes("/graphql") || url.includes("/v1/") || url.includes("/v2/")
  ) {
    try {
      const body = await res.text();
      apiCalls.push({ url, status: res.status(), contentType: ct, size: body.length, sample: body.slice(0, 500) });
    } catch {}
  }
});

await page.goto(url, { waitUntil: "networkidle2" });

for (const call of apiCalls) {
  console.log(`${call.status} ${call.url} (${call.contentType}, ${call.size}B)`);
  console.log(`  ${call.sample.slice(0, 200)}`);
}