Improper Asset Management

Search for older versions

api.target.com/v3
/api/v2/accounts
/api/v3/accounts
/v2/accounts

Accept: version=2.0
Accept api-version=3

/api/accounts?ver=2
POST /api/accounts

{
"ver":1.0,
"user":"hapihacker"
}

Search for non production versions

api.test.target.com
api.uat.target.com
beta.api.com
/api/private
/api/partner
/api/test

Postman

Postman Collection Runner

collection options, choose Edit, and select the Tests tab

pm.test("Status code is 200", function () { 
    pm.response.to.have.status(200); 
})

Run an unauthenticated baseline scan of the collection with the Collection Runner. Make sure that "Save Responses"

Next, use "Find and Replace" to turn the collection's current versions into a variable. Type the current version into "Find", update "Where" to the targeted collection, and update "Replace With" to a variable.

Open Postman and navigate to the environmental variables (use the eye icon located at the top right of Postman as a shortcut). Add a variable named "ver" to your Postman environment and set the initial value to "v1".

Use the collection runner again and investigate the results