mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
57 lines
2.1 KiB
Markdown
57 lines
2.1 KiB
Markdown
# API Security Testing with Postman — API Reference
|
|
|
|
## Tools
|
|
|
|
| Tool | Install | Purpose |
|
|
|------|---------|---------|
|
|
| Newman | `npm install -g newman` | CLI runner for Postman collections |
|
|
| Postman | Desktop app from postman.com | Collection creation and manual testing |
|
|
|
|
## Newman CLI Commands
|
|
|
|
| Command | Description |
|
|
|---------|-------------|
|
|
| `newman run <collection.json>` | Execute collection |
|
|
| `newman run <col> -e <env.json>` | Run with environment variables |
|
|
| `newman run <col> --reporters cli,json` | Output in CLI and JSON format |
|
|
| `newman run <col> --reporter-json-export out.json` | Export JSON results |
|
|
| `newman run <col> --timeout-request 10000` | 10s request timeout |
|
|
| `newman run <col> --delay-request 100` | 100ms delay between requests |
|
|
|
|
## Postman Test Script Functions
|
|
|
|
| Function | Description |
|
|
|----------|-------------|
|
|
| `pm.response.code` | HTTP response status code |
|
|
| `pm.response.text()` | Response body as string |
|
|
| `pm.response.json()` | Parsed JSON response |
|
|
| `pm.expect(val).to.equal(x)` | Chai assertion |
|
|
| `pm.expect(val).to.be.oneOf([])` | Value in expected set |
|
|
| `pm.expect(val).to.not.include(s)` | String not present |
|
|
| `pm.environment.set(k, v)` | Set environment variable |
|
|
|
|
## Collection Schema (v2.1.0)
|
|
|
|
```json
|
|
{
|
|
"info": {"name": "...", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"},
|
|
"item": [{"name": "...", "request": {...}, "event": [{"listen": "test", "script": {...}}]}]
|
|
}
|
|
```
|
|
|
|
## OWASP API Security Tests
|
|
|
|
| Test | Postman Assertion |
|
|
|------|-------------------|
|
|
| BOLA/IDOR | Expect 403/404 when accessing other user's resource |
|
|
| Auth bypass | Expect 401 without valid token |
|
|
| Mass assignment | Expect role field ignored in response |
|
|
| Injection | Expect no 500 or stack trace in response |
|
|
| Data exposure | Expect sensitive fields not in response |
|
|
|
|
## External References
|
|
|
|
- [Postman Learning Center](https://learning.postman.com/)
|
|
- [Newman Documentation](https://github.com/postmanlabs/newman)
|
|
- [Postman Test Scripts](https://learning.postman.com/docs/writing-scripts/test-scripts/)
|