Apisecure, 14 & 15 March 2023 - Rahul Dhawan, Senior Security Engineer at Postman.
summary
Workshop shows automated detection and exploitation of OWASP API risks using Postman Interceptor and the Postman app against Juice Shop and VAPI labs. Concrete findings: broken object‑level authorization lets one read/modify other users’ baskets, server returns 500 with SQL details (excessive info disclosure), HTTP parameter pollution bypasses checks, and a brute‑force run of a 200-password CSV reveals an admin123 login. Demos use Collection Runner, Flows/monitors and CSV-driven attacks to assert 200 vs 401 and integrate checks into CI.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 10:31Postman setup for API security
- 22:56Broken object level auth
- 33:56Broken user auth flaws
- 47:15Broken function level auth
- 58:24Security misconfigurations
- 1:00:34Summary
related talks
46mAPI Security – Divide & Conquer
25mHack-Proof Your API: Exclusive Attack Simulator Deep Dive 🛡️
22mAPI Security Testing with Postman: Best Practices and Techniques
15mJumpstart Security & Penetration Testing APIs
30mAPI Security - Divide & Conquer
47mAPIs Exposed!
23mTopics of Interest: vAPI: Vulnerable Adversely Programmed Interface (API Top 10)
44mAll your APIs are mine - Secure them now