# Hidden APIs - How Websites Accidentally Give You Everything 🎁

**URL:** <https://onehack.st/t/hidden-apis-how-websites-accidentally-give-you-everything/316009>\
**Category:** Tutorials & Methods\
**Tags:** tools, tips-tricks, ai\
**Created:** [January 2, 2026, 9:31pm UTC](https://onehack.st/t/hidden-apis-how-websites-accidentally-give-you-everything/316009 "2026-01-02T21:31:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![SRZ](https://onehack.st/user_avatar/onehack.st/srz/32/146132_2.png) [@SRZ](https://onehack.st/u/SRZ)\
**Post date:** [January 2, 2026, 9:31pm UTC](https://onehack.st/t/hidden-apis-how-websites-accidentally-give-you-everything/316009/1 "2026-01-02T21:31:42Z")

</div>

# 🌐 Finding Hidden APIs Step by Step for Beginners 🪜

(AKA: How to Find Hidden APIs and Unlock What’s Not on the Menu 🍕)

> 🗺 **One-Line Flow:** Press F12 → Watch websites talk to their kitchen → Find the secret menu items → Go deeper with forgotten files, time travel tricks, and phone app snooping.

* * *

### What Even Is an API?

Think of it like this:  
When you use Instagram, you see pretty pictures and buttons. But behind that, Instagram is just sending data back and forth — like a waiter taking orders to the kitchen.

**The API is the waiter.**

And sometimes… the waiter will give you stuff that’s not on the menu. 😏

> **🍕 Wait, Explain It Like I'm 5 (The Pizza Shop Thing)**
>
> Imagine a pizza shop:
> 
> - The **menu** = what they WANT you to see
> - The **kitchen** = where the real stuff happens
> - The **API** = the back door where employees go in and out
> 
> Most people order from the menu. But if you know about the back door, you can sometimes… see what else is cooking.
> 
> That’s what “finding hidden APIs” means. You’re not breaking in. You’re just using the employee entrance.

* * *

> **🔰 Level 1: The 'I Have Zero Skills But I Want In' Starter Method — Literally Just Press F12**
>
> **Step 1:** Open any website  
> **Step 2:** Right-click → “Inspect” (or press F12)  
> **Step 3:** Click the “Network” tab at the top  
> **Step 4:** Click around the website  
> **Step 5:** Watch the magic ✨
> 
> You’ll see a bunch of stuff appearing. Look for things that say “XHR” or “Fetch” — those are the website talking to its kitchen.
> 
> > **🎬 Okay But What Am I Actually Looking At? (Don't Panic, It's Easy)**
> >
> > When you filter by XHR/Fetch, you’ll see requests like:
> > 
> > ```auto
> > api/users/profile
> > api/posts/feed
> > graphql
> > 
> > ```
> > 
> > Click on any of these. Look at the “Response” tab.
> > 
> > **That’s the raw data.** No pretty interface. Just… everything.
> > 
> > Sometimes you’ll find data they didn’t mean to show you. Old features. Hidden info. The good stuff.
> 
> **[This GitHub repo](https://github.com/ropcat/reversing-unofficial-APIs)** is literally a free course on finding hidden APIs. Not tools. Not a list. An actual _methodology_ for discovering what websites are hiding.

* * *

> **🔮 Level 2: GraphQL — That Weird Thing That Gives You EVERYTHING If You Ask Nicely**
>
> Your Network tab shows XHR/Fetch. But in 2025, the real treasure is **GraphQL**.
> 
> Look for requests going to `/graphql` endpoints. If you find one, try this in your browser console or Postman:
> 
> ```graphql
> {__schema{queryType{fields{name}}}}
> 
> ```
> 
> If it works? You just downloaded the **entire API blueprint** — every query, every mutation, every field. It’s like the restaurant handing you the recipe book.
> 
> > **🕵️ They Blocked It? Lol No They Didn't — Here's How They Messed Up**
> >
> > Companies think they’re smart by blocking introspection. But they mess it up constantly.
> > 
> > **Try these bypasses:**
> > 
> > - Add a newline: `{__schema\n{queryType{name}}}`
> > - Use GET instead of POST
> > - URL-encode the query
> > - Add spaces: `{ __schema { queryType { name } } }`
> > 
> > **When it’s actually locked down:**  
> > Use **[Clairvoyance](https://github.com/nikitastupin/clairvoyance)** — it rebuilds schemas by exploiting error messages. When you type a wrong field, Apollo says stuff like `Did you mean 'userPassword'?`
> > 
> > Yeah. It literally tells you what fields exist. Thanks, Apollo.

* * *

> **🗺️ Level 3: Source Maps — Devs Accidentally Left The Answer Key In The Exam Room**
>
> This is criminally underrated.
> 
> When devs build websites, they compress JavaScript into unreadable garbage. But sometimes they leave behind `.map` files — which reverse the compression.
> 
> **Check if they exist:**
> 
> ```auto
> main.js → main.js.map
> bundle.js → bundle.js.map
> 
> ```
> 
> Just add `.map` to any JS file URL and see what happens.
> 
> > **💀 Holy Crap What Can I Actually Find In These Things?**
> >
> > If exposed, you get:
> > 
> > - **Original, un-minified source code** — readable variable names, comments, everything
> > - **Hardcoded API keys and tokens** (yes, including Stripe secrets)
> > - **Hidden admin endpoints** the UI doesn’t show
> > - **Internal routes** devs thought were private
> > 
> > **Google dork to find exposed maps:**
> > 
> > ```auto
> > ext:map intext:webpack intext:react -site:github.com
> > 
> > ```
> > 
> > **Tools:**
> > 
> > - [sourcemapper](https://github.com/denandz/sourcemapper) — extracts full source trees
> > - `source-map-explorer` (npm) — visualizes what’s inside
> > 
> > Real case: Security researchers found **hardcoded Stripe API secret keys** through source maps. Enabled unauthorized payments. Oops.

* * *

> **⏰ Level 4: Time Travel Recon — Old APIs Never Really Die, They Just Hide**
>
> APIs that existed **years ago** might still work. Companies update their docs but forget to actually kill the old endpoints.
> 
> **The Wayback Machine remembers everything.**
> 
> > **🛠️ Tools That Do The Time Traveling For You (Just Copy-Paste)**
> >
> > **[gau](https://github.com/lc/gau)** — pulls URLs from Wayback Machine, Common Crawl, AlienVault
> > 
> > ```bash
> > echo "target.com" | gau | grep -E "api|v1|v2|graphql" | sort -u
> > 
> > ```
> > 
> > **[waybackurls](https://github.com/tomnomnom/waybackurls)** — raw Wayback scraping
> > 
> > ```bash
> > echo "target.com" | waybackurls
> > 
> > ```
> > 
> > **[waymore](https://github.com/xnl-h4ck3r/waymore)** — Wayback + CommonCrawl + URLScan + VirusTotal combined
> > 
> > **What you’re looking for:**  
> > Found `/api/v1/admin/debug` that was removed from docs in 2021 but still responds with 200 in 2025? That’s your entry point.

* * *

> **📄 Level 5: Swagger Files — When Companies Upload Their Own Cheat Codes By Accident**
>
> Companies accidentally ship their full API documentation publicly. It’s literally a map of every endpoint.
> 
> **Common locations to check:**
> 
> ```auto
> /swagger.json
> /openapi.json
> /swagger/v1/swagger.json
> /api-docs
> /api/v1/docs
> /swagger-ui.html
> /.well-known/openapi.json
> 
> ```
> 
> Just… try them. You’d be surprised.
> 
> > **🔨 Tools That Hunt Swagger Files While You Grab Coffee**
> >
> > **[Autoswagger](https://github.com/darknet/autoswagger)** — auto-discovers and tests OpenAPI endpoints
> > 
> > **[APIFuzzer](https://github.com/KissPeter/APIFuzzer)** — once you have the spec, fuzz every endpoint
> > 
> > **[Kiterunner](https://github.com/assetnote/kiterunner)** — bruteforces API routes using smart wordlists
> > 
> > ```bash
> > kr scan https://target.com/api -w routes-large.kite
> > 
> > ```

* * *

> **📜 Level 6: JavaScript Mining — The Code Already Contains Every Secret, You Just Gotta Ctrl+F**
>
> The Network tab shows **active** calls. But the JavaScript files contain **all possible** endpoints — including ones the UI never uses.
> 
> > **🔍 What To Search For + Tools That Do It Automatically**
> >
> > **What to search for in JS files:**
> > 
> > ```javascript
> > /api/
> > /v1/
> > /internal/
> > /admin/
> > /debug/
> > "Authorization"
> > "Bearer"
> > "apiKey"
> > 
> > ```
> > 
> > **Tools that do this automatically:**
> > 
> > - **[LinkFinder](https://github.com/GerbenJavado/LinkFinder)** — extracts endpoints from JS
> > - **[JSFScan](https://github.com/KathanP19/JSFScan.sh)** — full JS recon suite
> > - **[Katana](https://github.com/projectdiscovery/katana)** with `-jc` flag (JavaScript crawl)
> > 
> > ```bash
> > katana -u "https://target.com" -jc -o js_endpoints.txt
> > 
> > ```

* * *

> **📱 Level 7: Mobile Apps — Web Got Smarter, But Phone Apps Are Still Snitching Hard**
>
> Web apps have gotten better at hiding stuff. Mobile apps? Still a disaster.
> 
> > **📲 The Step-By-Step 'Intercept Everything Your Phone Says' Method**
> >
> > **The basic flow:**
> > 
> > 1. Get the APK (Android) or IPA (iOS)
> > 2. Set up **mitmproxy** to intercept traffic
> > 3. Use **Frida** to bypass certificate pinning
> > 4. Watch every API call the app makes
> > 
> > **Certificate pinning bypass scripts:**  
> > [httptoolkit/frida-interception-and-unpinning](https://github.com/httptoolkit/frida-interception-and-unpinning)
> > 
> > **Static analysis (no interception needed):**  
> > Decompile the APK with **jadx** or **apktool** , then grep:
> > 
> > ```bash
> > grep -ri "api" ./
> > grep -ri "endpoint" ./
> > grep -ri "secret" ./
> > 
> > ```
> > 
> > Flutter apps are especially leaky — most devs forget to disable debug mode.

* * *

> **🔌 Level 8: WebSockets — Everyone Forgets These Exist And That's Why They're Gold**
>
> Everyone filters by XHR/Fetch. Real-time apps use **WebSockets** (`ws://` or `wss://`).
> 
> In DevTools → Network → Filter by **“WS”**
> 
> WebSocket APIs often:
> 
> - Skip authentication entirely
> - Use sequential/guessable IDs
> - Leak real-time data (chat messages, trades, internal comms)

* * *

> **⚠️ Why Every Tutorial From 2023 Is Now Wrong — What Changed**
>
> | What Changed | What It Means For You |
> | --- | --- |
> | GraphQL introspection now disabled by default | Use Clairvoyance + field suggestions instead |
> | Bot protection (Cloudflare, Akamai) fingerprints API clients | Simple `curl` gets blocked — need proper headers |
> | ~33% of APIs are “shadow APIs” | Best targets — they exist but aren’t monitored |
> | Certificate pinning is standard on mobile | Need Frida/Objection to bypass |
> | AI bot detection is everywhere | Behavioral patterns matter, not just headers |

* * *

> **🧪 The Full Workflow — Just Copy This Entire Thing And Run It**
>
> ```bash
> # 1. Passive URL discovery
> echo "target.com" | gau | tee urls.txt
> echo "target.com" | waybackurls >> urls.txt
> cat urls.txt | grep -E "api|v1|v2|graphql|swagger" | sort -u > api_endpoints.txt
> 
> # 2. Find JS files
> katana -u "https://target.com" -jc -o katana_out.txt
> cat katana_out.txt | grep "\.js$" | sort -u > js_files.txt
> 
> # 3. Check for source maps
> cat js_files.txt | while read url; do curl -s "$url.map" | head -c 100; done
> 
> # 4. Test GraphQL introspection
> curl -X POST "https://target.com/graphql" \
> -H "Content-Type: application/json" \
> -d '{"query":"{__schema{queryType{fields{name}}}}"}'
> 
> # 5. Hunt for Swagger files
> ffuf -w /path/to/swagger-wordlist.txt -u "https://target.com/FUZZ" -mc 200
> 
> ```

* * *

> **📚 The Only Resources You Actually Need (Bookmark These)**
>
> - **[Reversing Unofficial APIs](https://github.com/ropcat/reversing-unofficial-APIs)** — The methodology bible
> - **[Clairvoyance](https://github.com/nikitastupin/clairvoyance)** — GraphQL schema reconstruction
> - **[gau](https://github.com/lc/gau)** — Historical URL discovery
> - **[Katana](https://github.com/projectdiscovery/katana)** — Modern web crawler with JS parsing
> - **[Frida Scripts](https://github.com/httptoolkit/frida-interception-and-unpinning)** — Mobile cert pinning bypass

* * *

**Normal people see the website.**

**1Hackers see everything the website is hiding.** 🔍