Where does the legality with this lie? I’ve read cases where someone was jailed just for changing the ID in a url parameter. If you are intercepting network requests and then replaying them (with modifications?) in you own custom code, I bet under some laws this is “hacking”. Personally I would be afraid to post publicly that I’ve done this, seems like it could be used as an admission of guilt in a trial.