API Security Testing with Postman: Best Practices and Techniques
summary
Covers concrete tests for three OWASP API Top 10 issues: Broken User Authentication, BOLA, and Broken Function Level Authorization, with real-world proofs of concept like unsigned JWTs in Outlook, YouTube channel ID abuse, and OnePassword guest access. Shows exact Postman steps: remove or use expired tokens to check for 401s, swap resource IDs to detect object enumeration, replace admin keys with user keys to test function-level access. Demonstrates automating those JavaScript tests with Postman Monitors that run on a schedule and alert via email or Slack, configurable to notify up to 5 email recipients.
AI-written summary · about
chapters (11)
- 0:00Introduction to API security
- 1:12History of API vulnerabilities
- 2:37Common API vulnerabilities overview
- 3:20Broken user authentication
- 6:27Broken object level authorization
- 8:58Broken function level authorization
- 12:51Automating security tests with monitors
- 14:19Writing automated security tests
- 16:05Setting up Postman monitors
- 17:56Monitor results and notifications
- 20:40Additional integrations and conclusion
related talks
46mAPI Security – Divide & Conquer
17mAn API Security Testing Blueprint: Because Unit Tests Just Aren't Enough.
26mOffensive API Penetration Testing
25mHack-Proof Your API: Exclusive Attack Simulator Deep Dive 🛡️
15mJumpstart Security & Penetration Testing APIs
01h 01mApisecure, 14 & 15 March 2023 - Rahul Dhawan, Senior Security Engineer at Postman.
40mApisecure, 14 & 15 March 2023 - Ian Douglas, Senior Developer Advocate at Postman.
47mAPIs Exposed!