An API Security Testing Blueprint: Because Unit Tests Just Aren't Enough.
summary
Claims that unit tests alone miss interactions, auth gaps and runtime flaws and offers a concrete blueprint: start by inventorying architecture, environment and auth and test user roles; use Postman and Bub Suite for discovery and exploitation, run reusable Postman collections for automated checks, and use Bub Suite sequencer to measure JWT entropy; map findings to the OWASP Top 10 and ASVS, log all tests (including failures), avoid heavy fuzzing until the end to prevent locked accounts, and note the Optus incident exposing ~10 million records.
AI-written summary · about
chapters (12)
- 0:00API security testing intro
- 1:27Unit tests aren't enough
- 3:12Three pillars of API security
- 4:14SAST, DAST and HAST explained
- 5:16Pre-testing checklist
- 6:41Key questions before testing
- 7:46API discovery methods
- 8:27OWASP API Top 10 start
- 9:31Reporting security findings
- 10:34API testing tips
- 15:50Shift-left API security
- 16:12Conclusion and risks
related talks
22mAPI Security Testing with Postman: Best Practices and Techniques
15mJumpstart Security & Penetration Testing APIs
55mAPI Security Assurance via E2E Testing
53mHacking And Defending APIs: Red And Blue Make Purple
26mOffensive API Penetration Testing
08mAPI Security Risks
46mAPI Security – Divide & Conquer
44mShift-Left-Security with the Security Test Pyramid