web-api-analyzer

Intercept and analyze website API endpoints and client-side JavaScript logic.

Updated Aug 27, 2026

Search Tags:#playwright #network interception #crypto analysis #api reverse engineering #web api analysis #js hooking #har export

Ready to run

npx skills add https://github.com/warterbili/AUTO_REVERSE --skill web-api-analyzer

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: web-api-analyzer
Source: https://github.com/warterbili/AUTO_REVERSE/tree/main/skills/web/web-api-analyzer
Command: npx skills add https://github.com/warterbili/AUTO_REVERSE --skill web-api-analyzer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires playwright, and includes scripts (resource) components.

What problem does it solve?

Manually tracing website API endpoints, request parameters, and client-side encryption or signing logic is time-consuming and error-prone, especially for dynamic sites that load content asynchronously or obfuscate critical JavaScript operations.

Core Features & Use Cases

Network Traffic Capture: Intercept all XHR and fetch API requests with full headers, parameters, and response bodies from any target website.
Client-Side JS Analysis: Hook common crypto functions (CryptoJS, Web Crypto API, md5) and storage/cookie operations to uncover encryption, signing, and session management logic.
Use Case: Use this skill to reverse-engineer a web app's private API endpoints, extract request-signing algorithms, or capture authentication tokens for security testing.

Quick Start

Use the web-api-analyzer skill to capture all API requests and JS crypto hooks from the target website https://example.com.

Frequently Asked Questions about web-api-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I intercept and analyze website API calls using Playwright?▼

You can intercept website API calls by launching controlled Playwright browser sessions to capture full network traffic, including all XHR and fetch requests with headers, parameters, and response bodies for reverse engineering.

Can I hook JavaScript crypto functions to reverse engineer request signing?▼

Yes, you can hook common client-side JavaScript crypto functions like CryptoJS, Web Crypto API, and md5 to uncover dynamic request signing and encryption logic during web API analysis.

What is the best way to capture dynamic request signing logic on a website?▼

The best way to capture dynamic request signing logic is by injecting JavaScript hooks for crypto and storage operations to intercept dynamic parameters and trace client-side encryption algorithms.

Do I need Node.js to capture network traffic and export HAR files?▼

Yes, you need Node.js and the Playwright browser automation library to launch controlled browser sessions, capture full network traffic, and export the intercepted API results in structured JSON or HAR format.

Does web API analysis work with asynchronously loaded content and obfuscated JavaScript?▼

Yes, web API analysis works with asynchronously loaded content and obfuscated JavaScript by injecting hooks for crypto and storage operations to trace critical operations that standard network inspection misses.