[Feature request] Dump Freebox OS backup

[wikijm]

Hi Frédéric,

Could you please consider creating a script to get a full Freebox OS config backup?

I got the unpleasant surprise to get a Revolution Rev2 having a suddend death, and as you can imagine, I did a backup manually through WebGUI a long time ago 😞

My goal is to play such script through Jeedom/Home Assistant/You name it domotic solution.

Thanks! 😃

[wikijm]

By playing a bit with Burp Suite, I obtain this curl query:

curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: [freeboxalias].freeboxos.fr:[freeboxosport]' \
    -H $'Sec-Ch-Ua: \"Chromium\";v=\"127\", \"Not)A;Brand\";v=\"99\"'\
    -H $'Sec-Ch-Ua-Mobile: ?0'\
    -H $'Sec-Ch-Ua-Platform: \"Windows\"'\
    -H $'Accept-Language: fr-FR' -H $'Upgrade-Insecure-Requests: 1'\
    -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.89 Safari/537.36'\
    -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7'\
    -H $'Sec-Fetch-Site: same-origin' -H $'Sec-Fetch-Mode: navigate' -H $'Sec-Fetch-User: ?1' -H $'Sec-Fetch-Dest: document'\
    -H $'Referer: https://[freeboxalias].freeboxos.fr:[freeboxosport]/' -H $'Accept-Encoding: gzip, deflate, br' -H $'Priority: u=0, i' -H $'Connection: keep-alive'\
    -b $'FREEBOXOS=\"[freeboxostoken]"' \
    $'https://[freeboxalias].freeboxos.fr:[freeboxosport]/api/latest/backup/config/export'

[frolland04]

Hello ! Really interesting, I do not know Burp Suite - how to you manage get this curl command ? By inspecting data exchanged between the browser and the freebox when using "mafreebox.free.fr" ? As I was not really interested in backup all the settings (I did not change a lot of things except DHCP and network addressing stuff) I did not realize that "mafreebox.free.fr" was allowing to do a full backup. Sadly it is binary encoded, a big blob starting with "YEAH" ... maybe it is hiding something interesting ;-) I would be pretty much interested in backup'ing all the things in JSON (or equivalent), being able to change then "replay" some part of this JSON (again network adressing). So it is why I started to play with Freepybox (mostly a Python wrapper to Freebox API) : [ https://github.com/fstercq/freepybox | https://github.com/fstercq/freepybox ] [ https://dev.freebox.fr/sdk/os/dhcp/ | https://dev.freebox.fr/sdk/os/dhcp/ ] (but nothing about a config export) Did you have a look into the chunked binary that is returned by the query ? Regards, Frederic. De: "wikijm" ***@***.***> À: "frolland04/freebox" ***@***.***> Cc: "Subscribed" ***@***.***> Envoyé: Jeudi 8 Août 2024 16:19:18 Objet: Re: [frolland04/freebox] [Feature request] Dump Freebox OS backup (Issue #1) By playing a bit with Burp Suite, I obtain this curl query: curl --path-as-is -i -s -k -X $' GET ' \ -H $' Host: [freeboxalias].freeboxos.fr:[freeboxosport] ' \ -H $' Sec-Ch-Ua: \"Chromium\";v=\"127\", \"Not)A;Brand\";v=\"99\" ' \ -H $' Sec-Ch-Ua-Mobile: ?0 ' \ -H $' Sec-Ch-Ua-Platform: \"Windows\" ' \ -H $' Accept-Language: fr-FR ' -H $' Upgrade-Insecure-Requests: 1 ' \ -H $' User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.89 Safari/537.36 ' \ -H $' Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 ' \ -H $' Sec-Fetch-Site: same-origin ' -H $' Sec-Fetch-Mode: navigate ' -H $' Sec-Fetch-User: ?1 ' -H $' Sec-Fetch-Dest: document ' \ -H $' Referer: https://[freeboxalias].freeboxos.fr:[freeboxosport]/ ' -H $' Accept-Encoding: gzip, deflate, br ' -H $' Priority: u=0, i ' -H $' Connection: keep-alive ' \ -b $' FREEBOXOS=\"[freeboxostoken]" ' \ $' https://[freeboxalias].freeboxos.fr:[freeboxosport]/api/latest/backup/config/export ' — Reply to this email directly, [ #1 (comment) | view it on GitHub ] , or [ https://github.com/notifications/unsubscribe-auth/AI2HMNXGZDAEKERGJVUPXLLZQN46NAVCNFSM6AAAAABMGPEM2WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENZVHE2TCMJRHE | unsubscribe ] . You are receiving this because you are subscribed to this thread. Message ID: ***@***.***>

[wikijm]

Thanks for your answer 😄

Indeed, I'm using Burp Suite Community Edition to inspect HTTP and WebSockets trafic (you can start a Chromium webbrower with Burp Suite configured as web proxy, then you can forward or drop any web query).

And like you, I don't see anything related to OS config backup on https://dev.freebox.fr/sdk/os/#.