Kampala - Reverse-Engineer Apps into APIs

TL;DR

TL;DR: Kampala is a self-hosted MITM proxy that intercepts HTTP traffic from any app or browser, maps multi-step workflows, and lets you replay them as stable REST APIs — no more fragile browser automation scripts.

Source and Accuracy Notes

• Official site: zatanna.ai/kampala
• GitHub: zatanna-ai/kampala
• Documentation: docs.zatanna.ai

What Is Kampala?

Most software you rely on has no API. You either write brittle browser-automation scripts, pay for expensive third-party integrations, or manually do the work yourself. Kampala solves this by turning any software workflow into a reliable API endpoint you can call from your own tools.

Kampala runs as a local MITM (man-in-the-middle) proxy. When you route traffic through it, Kampala:

• Intercepts every HTTP/S request from any app, browser, or desktop software in real time
• Maps tokens, cookies, sessions, and multi-step sequences automatically
• Captures and replays sequences as stable, idempotent API calls
• Preserves your HTTP/TLS fingerprint so the target server cannot distinguish your automation from the original client

The result is a stable API wrapper around any software — without selenium, without screen scraping, without fragility.

Setup Workflow

Step 1: Install Kampala

Kampala runs as a self-hosted proxy on your machine or server. Install via the official installer:

# macOS / Linux
curl -fsSL https://get.kampala.dev | sh

# Or pull the Docker image
docker pull zatanna/kampala:latest

Step 2: Configure Your Browser or App to Route Through Kampala

By default Kampala listens on http://localhost:9090. Configure your system proxy or per-app proxy settings to route HTTP/S traffic through Kampala.

For mobile apps or desktop software, set the HTTP_PROXY environment variable:

HTTP_PROXY=http://localhost:9090 HTTPS_PROXY=http://localhost:9090 your-app-command

Step 3: Intercept and Map a Workflow

Open the Kampala web UI (usually http://localhost:9091) and start recording. Perform the workflow you want to capture — for example, logging into a web dashboard, filling out a form, or triggering a multi-step process.

Kampala captures every request in the sequence. You can review, label, and annotate individual steps.

Step 4: Export as an API Endpoint

Once your sequence is mapped, Kampala generates a stable endpoint you can call:

# Example: replay the captured sequence
curl -X POST http://localhost:9091/api/replay/my-sequence \
  -H "Content-Type: application/json" \
  -d '{"input_param": "value"}'

The exported API preserves authentication tokens, session cookies, and the correct request order — so it behaves exactly like the original human-driven workflow.

Deeper Analysis

Why MITM Over Browser Automation?

Traditional browser automation (Selenium, Playwright, Puppeteer) works by controlling a real browser. It is slow, resource-heavy, and breaks whenever the UI changes. A single CSS class rename can kill your entire automation pipeline.

Kampala operates at the HTTP layer, one level below the UI. It captures the actual API calls your browser or app makes — which are far more stable than their visual presentation. The underlying API calls rarely change even when the UI is redesigned.

Token and Session Mapping

One of Kampala’s most useful features is automatic token mapping. It tracks:

• OAuth access and refresh tokens
• Session cookies across multi-step flows
• CSRF tokens and other anti-CSRF measures
• API keys embedded in headers

When replaying a sequence, Kampala automatically refreshes expired tokens and manages session state — making long-running automations viable without manual intervention.

Fingerprint Preservation

Many services (banks, enterprise SaaS, anti-bot platforms) detect automation by analyzing TLS fingerprints, HTTP2 settings, and client hello parameters. Kampala preserves your original client’s fingerprint, making your automation traffic indistinguishable from a real browser.

Practical Evaluation Checklist

• Works with browsers, mobile apps, and desktop software via HTTP/S proxy
• Maps and replays multi-step sequences as REST API calls
• Automatically handles token refresh and session management
• Preserves HTTP/TLS fingerprint to avoid detection
• Exports sequences as callable API endpoints
• Supports replay with custom input parameters
• Self-hosted — no cloud dependency, no vendor lock-in
• Windows support is in development (waitlist available)

Security Notes

• Kampala runs locally. All traffic interception happens on your machine — no data is sent to Zatanna’s servers unless you explicitly configure cloud sync.
• Since Kampala acts as a MITM proxy, only route traffic you own or have permission to intercept.
• When replaying sequences, Kampala stores authentication tokens in local memory. Secure your Kampala instance with TLS and authentication if running on a shared server.

FAQ

Q: Does Kampala work with mobile apps? A: Yes. Set the HTTP_PROXY environment variable to point to your Kampala instance and the app’s traffic will be routed through it.

Q: How is this different from tools likemitmproxy or Charles Proxy? A: mitmproxy and Charles are debugging tools — great for inspecting traffic, but you still have to manually script replay logic. Kampala automatically maps sequences and exports them as stable API endpoints you can call programmatically.

Q: Does Kampala work with apps that use certificate pinning? A: Certificate pinning blocks MITM proxies by design. You would need to disable certificate verification on the client side, which requires root access or a custom build.

Q: Is there a cloud-hosted version? A: Currently Kampala is self-hosted only. All processing happens locally.

Q: What programming languages can call Kampala exported APIs? A: Any language that can make HTTP requests — Python, JavaScript, Go, Ruby, curl, etc.

Conclusion

Kampala fills a real gap: software with no API that you still need to automate. Instead of maintaining fragile browser-automation scripts or paying for expensive third-party integrations, Kampala lets you reverse-engineer the underlying HTTP traffic and wrap it in a stable API you control.

If you regularly work with SaaS tools, legacy software, or internal apps that lack APIs, Kampala is worth adding to your self-hosted toolkit.

Website: zatanna.ai/kampala