‫Instructor: Hi.
‫Within this lecture we are gonna see
‫how to install and use Postman.
‫Now that we have the Burp Suite,
‫we need one last thing to start pentesting
‫on our vulnerable API.
‫And that is the Postman.
‫So far, our vAPI is working
‫so there's nothing left to do over here.
‫So what I'm gonna do, I'm gonna go into Google
‫and search for Postman like this.
‫So Postman and of course,
‫you can just write Postman Download and something like that,
‫but it's very simple, it's postman.com.
‫So what is Postman?
‫Postman is an actually tool that lets us send requests
‫and get some responses back from a server
‫or from an end point from an API and analyze them.
‫It sounds a lot like Burp Suite, I know that
‫but they have completely different purposes.
‫In Burp Suite, we generally do penetration tests,
‫we interrupt or intercept the request
‫and then we manipulate them, and we observe the changes.
‫And we can do something like brute forcing
‫or encrypting on decrypting.
‫In Postman, we don't do that kind of stuff.
‫We simply send requests and get some responses back.
‫And it's a crucial tool
‫in order to create APIs and also test APIs.
‫If you're a web developer or a mobile application developer,
‫I am pretty certain that you have used Postman before.
‫So if you have the post on your computer
‫up and running right now,
‫maybe you can just fast forward a little bit
‫and just see how to import the JSON file
‫that comes with the resources of this vAPI challenge
‫and then go along.
‫But if you are new to Postman, then just stick with me
‫and see how to download it and install it.
‫And in fact, it is not that hard to download and install it.
‫You can just come over here to postman.com
‫and you can see the product over here.
‫Of course, there is like a free version
‫and some options, paid options as well.
‫We're gonna completely use the free version.
‫And in fact, you can use the web version,
‫web interface of the Postman without even downloading it
‫but I'm going to download it.
‫So I'm going to show you how to use the web version as well.
‫So if you take a look at the tools section,
‫you can see why we use the Postman.
‫For example, we can use Postman to test our APIs.
‫So we can send requests, we can get responses back,
‫we can actually write headers and parameters,
‫and also, we can design the APIs inside of the Postman
‫so that it would be much more structural.
‫We can write documentation, we can do testing,
‫we can actually use mock servers
‫in order to test the APIs and endpoints.
‫We can monitor what's going on
‫and we can detect the APIs as well.
‫So it's a very good platform.
‫It's all in one solution for the APIs.
‫And if you go over here,
‫you can try the test version, try the web version.
‫Web interface and you don't even need to download it.
‫But I suggest you download it because it's a very good tool.
‫It's a good tool to have it on your computer
‫and you can actually create a free account and that's it.
‫When you go to postman.com/download,
‫you will see that you can download it
‫for your own specific operating system.
‫Right now, I'm going to choose Mac Intel Chip
‫because that is why I'm using right now.
‫But if you're using something else, then just download it.
‫If it is compatible with Windows,
‫it is compatible with Linux.
‫But this is one of the reasons why we are doing this section
‫inside of our own host machines
‫rather than the Kali Linux.
‫I haven't tried Postman on Kali Linux yet.
‫I am pretty certain that it works, but I'm very certain
‫that it works on Mac and Windows without any issues.
‫Furthermore, we don't need any kind of functionality
‫from Kali Linux as well.
‫Postman and Burp Suite will be okay for us.
‫So make sure you download this Postman app.
‫And if it asks for you to sign up,
‫please make sure you sign up as well.
‫There is nothing special you have to do about installing it.
‫Just double click on it and hit next, next, next
‫give the necessary permissions and it's okay.
‫It's gonna be okay.
‫So what I'm going to do, I'm going to open the Postman
‫and show you what it looks like.
‫So right now, I can just minimize this
‫and I'm going to delete the certificate as well.
‫I'm going to search for Postman and just open it.
‫So feel free to pause the video, download the Postman,
‫install the Postman and open it.
‫Once you open it, it will probably ask you to sign up
‫and after you sign up freely or without paying anything,
‫you can just go in a dashboard like this.
‫So this user interface changes from time to time.
‫It gets updated, but you will see
‫this kind of menus every time.
‫Right now, I have this vAPI collection over here.
‫I'm going to delete it.
‫I have tried it before so I'm going to delete it
‫so that you can see how to import it as well.
‫So this is a workspace.
‫In a workspace, you can import the API documentation
‫or endpoints, you can test them,
‫you can create them, and so much more.
‫And on the left-hand side, we see the collections
‫we see the API module, we see environments.
‫I'm going to delete this as well.
‫I'm going to talk about what an environment is later on.
‫Don't worry about it.
‫Right now, it is empty.
‫We see other stuff, but basically, we will work
‫on collections most of the time.
‫In collections, you can create a collection of your own
‫like for different endpoints of this vAPI.
‫As you can see, there are 10 APIs
‫in this vulnerable API CTF.
‫You can create it one by one yourself.
‫But the in order to be convenient,
‫this vAPI, guys gave us the JSON as a resource.
‫So as you can see, there are endpoints
‫over here like post this, get this.
‫So rather than dealing with this,
‫we are going to just import this thingy
‫and make it compatible with our own server.
‫I'm going to show you how to run one of these things.
‫For example, if we go to my IP address
‫/vapi/api1 and user for example,
‫nothing happens because it's supposed to request.
‫We need to send some parameters along with it.
‫But if we do kind of a get request,
‫we may get something out of it.
‫Sending a request is nothing more
‫than sending or just browsing through that link.
‫As you can see, it asks
‫for an API ID over here, let me just test this.
‫So I'm gonna go over here and try to get the first user.
‫And it gives me 404, but you get the point.
‫Rather than just browsing here,
‫rather than pasting these endpoints to my URL like this,
‫we are going to send it via Postman
‫and we can send the parameters and headers
‫and all the necessary information along with this request.
‫So that it will actually work.
‫Because if we go to this URL on our browser, as you can see,
‫we are not sending the required parameters,
‫so it doesn't work.
‫So that's exactly what we're gonna do.
‫Let me show you how to do it.
‫Go into the resources, no, not the resources
‫go into the Postman folder.
‫Inside of the Postman folder, you will see,
‫there are two JSONs.
‫First of which is the environment
‫and second of which is the collection.
‫So right now, I'm going to find a way to import them.
‫So I'm inside of the collection tab at left-hand side.
‫What I'm going to do,
‫I'm going to click on this plus button,
‫it creates a new collection.
‫Let me delete that.
‫It was not a good idea.
‫I believe we can delete that
‫and I believe we can just go to menu from file
‫and say something like import, here you go.
‫So I'm going to delete this new collection.
‫I'm not going to use it.
‫I'm going to go to the menu
‫and say import and choose the file from my computer.
‫You can also drag and drop obviously,
‫but I'm going to go into the desktop and to Postman,
‫and not the environment one, but the collection one.
‫I'm going to choose the collection and say import.
‫Once I do that, it'll appear over here like this.
‫And as you can see, once you click on it,
‫you can see the API1, API2, API3.
‫we are gonna see how to use it
‫but I'm going to import this one more time
‫because I'm going to import the environment again.
‫So what is the environment?
‫We're gonna talk about it, don't worry about it.
‫If you go to environment section,
‫you can see the environment over here.
‫So in the collections, go to the API1.
‫And as you can see, we can see the get user,
‫create user, update user along with the URL.
‫So this is it.
‫This is the URL
‫and once I give the necessary information,
‫I can hit the send button and it will send a request for me.
‫Right now, if I send this request, it won't work
‫because it doesn't have the necessary information.
‫We haven't given it yet.
‫But as you can see,
‫we get the error and we can just do something accordingly
‫to solve this problem.
‫For example, if I click over here,
‫if I hover over the host, it says that unresolved variable.
‫So what does it mean?
‫It means that I have to come over here
‫and give my IP address rather than host
‫but I'm not going to do that.
‫I'm not gonna do that.
‫Because every time I go into any API over here,
‫like any endpoint,
‫I will have to do that if I just change it manually.
‫As you can see, it all has the host variable.
‫And host sense for our IP address.
‫So rather than changing it one by one,
‫I'm gonna go into the environment
‫and click on the vAPI environment.
‫So as you can see, there is a host variable over here
‫and the initial value is local host.
‫Rather than local host,
‫I'm just gonna write my own IP address
‫and this is my IP address over here.
‫I'm gonna copy it and paste it over there
‫and also paste it over the current value.
‫And then I'm going to save this.
‫So if you hit on the save button over here,
‫don't forget to hit on the save button.
‫And if you go to collection, now,
‫it'll resolve to the IP address of our own.
‫It doesn't resolve, it says that unresolved variable
‫because we need to change the environment, I believe.
‫Click on the vAPI.
‫Click on the vAPI and come over here
‫to No Environment and select the vAPI environment.
‫Here you go.
‫Once you do do that, as you can see,
‫it will inherit all the variables
‫that we have written over there in the environment.
‫Now you know what an environment is.
‫If you come over here, hover over the host variable.
‫As you can see, we get the value, we get the IP address.
‫And that is what we need.
‫If I send this right now, again,
‫it doesn't send for some reason
‫because I believe we need to change this.
‫We need to change this ID as well.
‫As you can see there is another unresolved value over here,
‫but if we change this, I believe it would work.
‫Let me try this.
‫And by the way, I can go to environment
‫and change the variable from there as well
‫but it doesn't make much sense because it's only in one API.
‫We can also change the variables
‫from here as well without touching the environment.
‫But it's a very good idea to go with the environment.
‫So it would be applicable
‫for all of the things inside of our API.
‫I'm just showing you guys how to use the Postman
‫I'm just getting you to know it.
‫Don't worry about it.
‫We're gonna see this in details.
‫Let me do one API call.
‫I'm gonna go into the first one, the post, the create user.
‫Let us test to see if this is working.
‫So we have a post request.
‫And we also have the get request, put request.
‫Maybe you don't know the difference between them.
‫Generally, when we send the data
‫to a server or to an endpoint, we use post request.
‫It is not mandatory, but it's the general convention.
‫Many developers choose to do that.
‫If we are trying to get some information from the API,
‫we can use the get request.
‫If we are trying to update any value,
‫we can use the put request.
‫So we know what kind of request
‫that we are getting over here
‫like post request, get request, put request.
‫You don't have to change any of this.
‫So first one is to create a user.
‫So I'm seeing this post request.
‫And you can change the tabs from here like authorization.
‫We don't need any authorization.
‫As you can see,
‫you can see the headers like content length, content type.
‫Many of the time, you won't even have
‫to touch the headers over here.
‫So you don't need to change any of this.
‫This is per field for us inside of the Postman.
‫And if you didn't get this Postman, as you can see,
‫you should go to the Burp Suite and catch the package
‫and try with it and it's gonna take so much time.
‫So make sure you install the Postman
‫and import the JSON file that comes with the challenge.
‫So here, we have the username, name
‫and the course and password thingies.
‫I'm just gonna give some random things over here
‫like username, Atil, name, my name,
‫course web pentesting password.
‫I don't know, atil123.
‫I'm just going with the random parameters.
‫I just want to see if I sent something,
‫yeah, there are some tests over here.
‫We are gonna talk about this.
‫So when we send a request,
‫this test gets executed automatically.
‫We don't need to change anything.
‫All you gotta do is just change the parameters
‫in the body and we are just doing this for test purposes.
‫And I sent this and as you can see,
‫it didn't even get a response back.
‫It doesn't work.
‫That's what I was trying to find out.
‫And if I go over host, yeah, by mistake,
‫we included HTTP tag two times.
‫In the host, as you can see, it says HTTP.
‫So it's coming HTTP, HTTP doesn't work.
‫Going to the environment one more time, delete the HTTP,
‫just leave the IP address over here.
‫From the initial value and also current value as well.
‫Make sure you delete every possible space and stuff.
‫Don't leave anything over here rather than the IP address.
‫Delete everything, just leave the IP address.
‫Come over here and try to send it one more time.
‫Just give some random usernames and names and stuff.
‫As you can see, host is okay right now.
‫All I gotta do is just send this and see what happens.
‫So right now, it works as you can see
‫I'm getting the username, I'm getting the name.
‫So we created a user.
‫So what we did in this lecture is just to install
‫the postman and make sure it works.
‫We are going to talk about what we are doing here
‫and why we are doing here.
‫We get an ID, so we don't know what to do with it.
‫Maybe you don't understand what's going on.
‫That's okay.
‫All you gotta do is just make sure your postman works.
‫And we are gonna talk about this in depth
‫in the upcoming lectures.
‫Right now, we have what we need.
‫We have the Postman, we have the Burp Suite
‫and we have the up and running API.
‫So we are gonna stop here and within the next lecture,
‫we're gonna start pentesting.