Reverse Engineering APIs

Hacking Sonos and Bicing APIs with APItools.
ApiDays

Transcript

1. Reverse Engineering APIs
   Raimon Grau & Michal Cichra
   3scale
   

   View Slide

2. Inspecting APIs
   github.com/kidd & github.com/mikz
   3scale
   

   View Slide

3. Debugging APIs
   raimon@3scale.net & michal@3scale.net
   3scale
   

   View Slide

4. APIs Everywhere
   

   View Slide

5. Get in touch! hello@apitools.com
   Cases of study
   ● ‘Hidden’ API: Sonos
   ● Combining APIs: Bicing on steroids
   

   View Slide

6. Get in touch! hello@apitools.com
   Sonos
   

   View Slide

7. Get in touch! hello@apitools.com
   Sonos
   

   View Slide

8. Get in touch! hello@apitools.com
   Sonos
   

   View Slide

9. Get in touch! hello@apitools.com
   Sonos
   

   View Slide

10. Get in touch! hello@apitools.com
    Sonos
    

    View Slide

11. Demotime!
    

    View Slide

12. Yay! :) or nay :(
    

    View Slide

13. Get in touch! hello@apitools.com
    What else you could do?
    ● Transfer song from Spotify to the Sonos
    ● Backup playlists
    ● Stream the music to remote locations
    ● Vote the songs added to the queue
    

    View Slide

14. Get in touch! hello@apitools.com
    Case 2: Api aggregation
    Bicing + Google Maps
    Source: Carlos Mejía Greene https://www.flickr.com/photos/carlitos/3101121106/ CC BY-NC-SA 2.0
    

    View Slide

15. Get in touch! hello@apitools.com
    Improvements
    ● Reduce transfer size
    ● Reduce roundtrips
    ● Improve accuracy by getting info
    from multiple sources
    ● Improve API interface
    

    View Slide

16. Get in touch! hello@apitools.com
    Api Aggregation
    Mobile
    app
    Middleware
    Web APIs
    requests
    responses
    

    View Slide

17. Get in touch! hello@apitools.com
    Api Aggregation
    Mobile
    app
    Middleware
    Web APIs
    requests
    responses
    http://techblog.netflix.com/2013/01/optimizing-netflix-api.html
    

    View Slide

18. Demotime!
    

    View Slide

19. Get in touch! hello@apitools.com
    How we improved?
    Size Savings Response time
    Original XML 131k ~0.7s
    JSON 80k 39% ~0.7s
    JSON with
    distances
    91k 30% ~0.7s
    nearest 10 5k 96% ~0.8s
    

    View Slide

20. Get in touch! hello@apitools.com
    What APIs to combine?
    Hue + Google Calendar
    Google Maps + Foursquare
    Sonos + Last.fm
    Dropbox + Github
    Almost any, actually
    

    View Slide

21. Get in touch! hello@apitools.com
    What do we get from it?
    ● As hackers we like to know what’s under the
    hood
    ● Cross API
    ● We can ‘discover’ hidden APIs. :)
    ● It’s fun!
    ● We can improve performance by
    aggregating multiple calls.
    

    View Slide

22. Get in touch! hello@apitools.com
    Special Treat
    Primavera Sound Festival 2014
    fake apps on Google Play Store
    real iOS app with a twist
    

    View Slide

23. Thank You
    and
    Happy Hacking!
    www.apitools.com
    @apitools - hello@apitools.com
    raimon@3scale.net /
    michal@3scale.net
    

    View Slide