[pjc50]

> How do you reverse engineer an API

For HTTP, this is about as easy as it gets in terms of reverse engineering. In firefox, just hit ctrl-shift-q while on any modern website. The network requests made will be displayed for you and you can then start making your own by guesses at what the programmer would have done.

e.g. on HN you can see that each upvote button press loads an image from

https://news.ycombinator.com/vote?id=14786509&how=up&auth=2d...

or twitter I can see that pressing "retweet" makes a request to "https://api.twitter.com/1.1/statuses/retweet.json" with a payload of {id "some tweet id"}.

Try it, it's fun and entertaining.

The proper "hacker stuff" is when you have to break out a hex editor, instruction set decoder, or in-circuit debugger probe.

[colejohnson66]

Is posting your auth number safe?

[pjc50]

I did wonder, but they appear to be unique not just to the page but to the specific link being upvoted.