It’s just not feasible to iterate through large payload lists in a reasonable amount of time. Portswigger has crippled Burp’s Intruder tool in the Community edition and only offers the full power of Intruder to those with a Professional (or higher) license.

There is a reason why in the Beginner’s Guide to API Hacking I highly recommended you buy Burp Suite Professional. In the context of the Postman Collection Runner over Burp Intruder, there is one key reason you might want to use Postman… and that’s speed. I say use the tool(s) you are most comfortable with. The whole Postman vs Burp is a great debate had by some. Why use the Postman Collection Runner over Burp Intruder? Through the PostMan Collection Runner, you can iterate through your specifically-crafted payload list and test API endpoints for injection vulnerabilities by injecting payloads into the requests.Ĭonfused yet? What I am trying to say is you can look for vulnerabilities (not just Injection flaws) by injecting malicious data into your API requests, thanks to the Collection Runner. Your malicious data can trick the API into executing unintended commands or accessing data without proper authorization. Injection flaws, such as SQL, NoSQL, Command Injection, etc., occur when untrusted data is sent to an API as part of a command or query. If you look at the top 10 classes of vulnerability as described in the OWASP API Security Top Ten, Injection flaws rank #8 on the list. What is Payload Injection in the context of APIs?

As API security testers, we can weaponize this same feature-set to feed malicious data through payload injection to our in-scope APIs under test. Many QA teams swear by its ability to build a sequence of requests to test more complex scenarios that can take input from data files, usually in a CSV or JSON format. The Collection Runner is an extremely powerful tool for data-driven testing. It logs your request test results and can use scripts to pass data between requests and alter the request workflow. The Postman Collection Runner enables you to run the API requests in a collection in a specified order. Stay tuned, it’s gonna be a wild ride! What is the Postman Collection Runner?

Burp suite professional