Can someone find the endpoint for getting mutual friends? a user profile only shows upto 13 friends but in the app if you can click on them to see the full list so it is possible

[NeedNot]

^

[NeedNot]

alright i never got the proxy to work but I was able to find the endpoint is
https://mobile.bereal.com/api/relationships/friends/common/userid
by other means.

[Lukas1h]

"other means"?

[NeedNot]

idk if it's legal or not but i decompiled the apk and searched for strings and found lists of api endpoints

[MrAn0nym]

idk if it's legal or not but i decompiled the apk and searched for strings and found lists of api endpoints

Quite certain that decompiling is legal.
Out of curiosity, what exactly did the string contain?

[NeedNot]

well considering it's obfusicated (or at least mostly) it's quite hard to search anything but loading the project in android studio then searching using ctrl shift f opens the project search, i searched for mobile.bereal first off hoping to find all the api endpoints but that is not the case, idk how exactly but the decompiled code doesn't anywhere include the first part of the api which is mobile.bebreal.come/api but you can search for anything that comes after so for example i searched relationship and it showed there is file with interfaces with all the endpoints related to relationships, you can repeat this for the other endpoints. pretty much unless you checked every string I dont know if you could find new endpoints but you can find different endpoints related to known ones

edit: there were a few endpoints that seemed too good to be true and sure enough they were 404

[MrAn0nym]

edit: there were a few endpoints that seemed too good to be true and sure enough they were 404

Probably locked behind some form of authentication-layers

[userbradley]

@NeedNot You're welcome to get in contact and I will add the URL's you've found to the repo? There is a contact button on my site if you fancy

[NeedNot]

I dont exactly remember the urls. they're all just stuff you can search strings for in the apk or use http proxy.