[andrewingram]

At some point you learn to debug the network requests in your own apps or websites. Once you've done that, it doesn't take a big leap of imagination to realise you can use the same techniques to look at the network requests for other apps and websites. Once you have enough sample requests and responses, you can usually figure out how it all fits together. Sometimes networking might be obfuscated (intentionally or otherwise) to the point that it's much more challenging, but the vast majority of products out there are easily inspectable.