Leveraging Postman for Security Testing
summary
Postman collections query AWS IAM REST APIs to run an automated audit of 9 controls from the AWS best practices fork, pushing noncompliant findings to a Slack webhook; the collection runs as a monitor every 5 minutes and reports a “healthy” graph when successful. An offensive collection implements a 16-stage attack (SSRF -> instance metadata v1 -> temporary creds -> create SSH key, user, spawn EC2 with miner) and the audit flags the over‑permissive role (audit #8), proving the tooling works end to end.
AI-written summary · about
chapters (15)
- 0:00Introduction to Postman security
- 1:03Why security testing matters
- 2:04Defining audit standards
- 3:49Importing the audit collection
- 6:37Setting up environments
- 8:21Running the audit collection
- 10:25Analyzing audit results
- 12:34Auditing for compliance
- 13:15Creating monitors for continuous auditing
- 16:45Testing alerts with attacks
- 21:42Attack workflow demonstration
- 25:57Detecting overprivileged roles
- 27:19Customizing audit collections
- 28:22Learning Postman basics
- 29:27Q&A and references
related talks
17mAPI Testing Unlocked
37mBuilding a secure BFF at Postman
01h 01mApisecure, 14 & 15 March 2023 - Rahul Dhawan, Senior Security Engineer at Postman.
58mImplementing compliance, assurance, and auditing on
40mApisecure, 14 & 15 March 2023 - Ian Douglas, Senior Developer Advocate at Postman.
26mAWS (mis)configuration from an attacker’s-eye view
32mContinuously assess controls for risk and compliance
20mFantastic AWS Attacks and Where to Find Them