ALL THE DATA CAN BE YOURS
This post goes over various methods for discovering and utilizing undocumented APIs to reverse-engineer web apps. These techniques range from searching GitHub for public code and analyzing fetch requests and robots.txt files to leveraging Google's cached errors and guessing API endpoints based on patterns.