4 ms·
Show HN: Metlo (YC S21) – An Open Source API Security Tool
Metlo - An Open Source API Security Tool
Hey folks! Excited to share what we’ve been working on for the last couple months. Metlo is a self hosted, open source first API security platform that inventories, tests and protects your API endpoints:
- We inventory your endpoints by scanning API traffic and detecting all your endpoints along with the sensitive data they contain.
- We generate information your security team may find useful like Open API Specs and risk scores for each endpoint.
- After this we discover vulnerabilities like unauthenticated endpoints returning sensitive data or missing HSTS headers.
- Finally Metlo detects any anomalous behavior on sensitive endpoints in real time so you can detect 0-day attacks as they're happening.
We have a demo environment to play around with here http://demo.metlo.com/ http://demo.metlo.com/. Also, Here's a demo video if you would like a quick walk through of the product :) https://www.loom.com/share/349c9e5f267741e9a0fcd2dfd1f9956f https://www.loom.com/share/349c9e5f267741e9a0fcd2dfd1f9956f
- shrisukhani 4y agoHi HN! I'm a co-founder of Metlo. So excited to finally share this here. @ashekhawat and I will be hanging out here for the next few hours to answer any questions you have! :)
- NinadSinha 4y agoHi HN! I'm Ninad, an engineer at Metlo. Here to answer questions about Metlo, API security, or anything else even tangentially related!
- freeqaz 4y agoHow do you generate an API Spec is there isn't one? (I've spent time working on this problem before, so I'm curious.) Also, how to prevent this tool from spamming everybody with alerts? I've used various DAST tools like OWASP ZAP before and ultimately they end up getting turned off because of anger fatigue. (At Uber we trained an entire ML model to hide noisy alerts based on us upvoting/downvoting them.)
- ashekhawat 4y agoHey @freeqaz! We analyze trace data that we capture from production traffic to generate what the Open API Spec could be. Here is an example of an auto generated spec: https://demo.metlo.com/endpoint/2be9f63e-a436-4ffc-b85a-e42105edb7da https://demo.metlo.com/endpoint/2be9f63e-a436-4ffc-b85a-e421.... This is the code in our repo: https://github.com/metlo-labs/metlo/blob/master/backend/src/services/jobs/generate-openapi-spec.ts https://github.com/metlo-labs/metlo/blob/master/backend/src/... To avoid noisy alerts we've tried very hard to focus on areas where we won't have high false positives. Also, unlike ZAP, since we analyze realtime production traffic we have more data to work with so we can make a more informed model. For example we would catch anomalies like high usage on endpoints that return sensitive data, endpoints that normally have authentication that where unauthenticated requests are succeeding, strange ordering of API requests by a single user, etc...
- allanmacgregor 4y agoHey @ashekhawat can the generated specs exported out of metlo?
- ashekhawat 4y agoYup, there is a button to download at the top right of the spec: https://demo.metlo.com/endpoint/2be9f63e-a436-4ffc-b85a-e42105edb7da https://demo.metlo.com/endpoint/2be9f63e-a436-4ffc-b85a-e421...