skills.rest
warterbili
warterbiliCOMMUNITY
Explore all skills by this author →
Website𝕏@lsdwaterbiliGitHub

web-api-analyzer

Intercept and analyze website API endpoints and client-side JavaScript logic.

Updated Aug 27, 2026
Search Tags:#playwright#network interception#crypto analysis#api reverse engineering#web api analysis#js hooking#har export
One-click install
npx skills add https://github.com/warterbili/AUTO_REVERSE --skill web-api-analyzer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-api-analyzer
Source: https://github.com/warterbili/AUTO_REVERSE/tree/main/skills/web/web-api-analyzer
Command: npx skills add https://github.com/warterbili/AUTO_REVERSE --skill web-api-analyzer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires playwright, and includes scripts (resource) components.

What problem does it solve?

Manually tracing website API endpoints, request parameters, and client-side encryption or signing logic is time-consuming and error-prone, especially for dynamic sites that load content asynchronously or obfuscate critical JavaScript operations.

Core Features & Use Cases

  • Network Traffic Capture: Intercept all XHR and fetch API requests with full headers, parameters, and response bodies from any target website.
  • Client-Side JS Analysis: Hook common crypto functions (CryptoJS, Web Crypto API, md5) and storage/cookie operations to uncover encryption, signing, and session management logic.
  • Use Case: Use this skill to reverse-engineer a web app's private API endpoints, extract request-signing algorithms, or capture authentication tokens for security testing.

Quick Start

Use the web-api-analyzer skill to capture all API requests and JS crypto hooks from the target website https://example.com.

Frequently Asked Questions about web-api-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I intercept and analyze website API calls using Playwright?▼

You can intercept website API calls by launching controlled Playwright browser sessions to capture full network traffic, including all XHR and fetch requests with headers, parameters, and response bodies for reverse engineering.

Can I hook JavaScript crypto functions to reverse engineer request signing?▼

Yes, you can hook common client-side JavaScript crypto functions like CryptoJS, Web Crypto API, and md5 to uncover dynamic request signing and encryption logic during web API analysis.

What is the best way to capture dynamic request signing logic on a website?▼

The best way to capture dynamic request signing logic is by injecting JavaScript hooks for crypto and storage operations to intercept dynamic parameters and trace client-side encryption algorithms.

Do I need Node.js to capture network traffic and export HAR files?▼

Yes, you need Node.js and the Playwright browser automation library to launch controlled browser sessions, capture full network traffic, and export the intercepted API results in structured JSON or HAR format.

Does web API analysis work with asynchronously loaded content and obfuscated JavaScript?▼

Yes, web API analysis works with asynchronously loaded content and obfuscated JavaScript by injecting hooks for crypto and storage operations to trace critical operations that standard network inspection misses.

Related Skills

Explore More Software Engineering Skills→
dallaydallay

webapp-testing

Automate Playwright browser testing and debugging for local web applications.

Official
Intermediate
igbuendigbuend
8

digital-signature-pattern

Implement digital signature patterns with asymmetric cryptography for data integrity.

Community
Advanced
KunCheng-HeKunCheng-He
8

playwright-cli

Automates browser workflows and generates Playwright test code via command-line.

Community
Advanced
MuhammedSuhaibMuhammedSuhaib
5

nextjs-16-async-apis

Enforces asynchronous patterns for Next.js 16 APIs like cookies, headers, params, and searchParams.

Community
Advanced