API Security with Postman and Qualys
summary
Qualys Web Application Scanning now accepts Postman Collection support in Qualys WAS uploads and runs authenticated API scans using exported collections plus environment variables and pre‑request scripts, executing collection tests and saving tokens; demo scans against a vulnerable "tiredfold" API surface find BOLA, broken auth, mass‑assignment, SQLi, XSS, path disclosure and insecure transport. The product parses GraphQL, integrates with CI/CD, Burp and a WAF, and an upcoming static OpenAPI assessment and conformance scanner checks contracts and hardening.
AI-written summary · about
chapters (6)
- 0:00Introduction to API security
- 3:14OWASP API Security Top 10
- 11:19Qualys Web App Scanning overview
- 16:33Demo setup with Postman
- 23:55Scan results and vulnerabilities found
- 25:42Q&A and closing remarks
related talks
01h 01mApisecure, 14 & 15 March 2023 - Rahul Dhawan, Senior Security Engineer at Postman.
08mAutomated Security Testing for JS Apps
15mJumpstart Security & Penetration Testing APIs
17mAn API Security Testing Blueprint: Because Unit Tests Just Aren't Enough.
25mHack-Proof Your API: Exclusive Attack Simulator Deep Dive 🛡️
40mApisecure, 14 & 15 March 2023 - Ian Douglas, Senior Developer Advocate at Postman.
46mAPI Security – Divide & Conquer
09mAutomated Application Security Testing