ashekhawat

We use a new browser for each session you create! We don't share the browsers between different customers.

Sorry for the confusion, yes we do! https://docs.hyperbrowser.ai/guides/connect-with-puppeteer

Happy to help with anything :)

We will definitely look into it! As we are adding more users scalability is our primary concern right now though

Of course, would love for you to take a look! I mentioned in another comment but we are working on lower cost/faster scraping focused endpoints, It's coming next week

We keep "prewarmed" browsers ready for new sessions. Looking into firecracker though!

We don't have that yet, but you could definitely do it in your own scripts right now using our browser. We'll try to think of ways to make it easier though :)

Thank you! We do make sure we are using legitimate proxy providers. Also happy to manually set it to the provider of your choice if you are interested in doing that :)

Hey! Completely hear you on that, right now we just have endpoints for headless browsers, this is a instance running chrome with dedicated resources that you have full access to. This comes with proxy services and captcha solving. This comes at a higher cost but you will get blocked less and can do much more, like browser automations.

Dedicated endpoints for just scraping like scraping bee are coming next week at a discounted price! In the mean time let me know if there is anything you would like that scraping bee is missing :)

We actually keep a pool of browsers ready so when a request comes we just assign it to an already running browser. This way in most situations there is no actual waiting for chrome to startup!

Just docker containers in GCP and AWS. We do all the instance management ourselves. It seems like you are working on infra for this from your bio! Send me an email would love to chat :)

Hey! So we have to use a different proxy service for some sites (LinkedIn included). Just ask in the app support and we can do that. We are also making custom endpoints for LinkedIn as well that should be ready soon, Ill shoot you an email once we have that!

Hey, 100 max on our paid plan but I can enable 1k concurrently if you want!

Hey! Yes tests can automatically be created based on the API traffic Metlo captures. Thats also the main difference between Metlo and Nuclei… we autogenerate tests based on the API schemas discovered for common vulns. You can also customize test generation using our templates!

Hey! For GQL we currently count each distinct query string your service receives as an endpoint. We understand that may not be ideal for some use cases (i.e. if you have customers sending arbitrary queries to your backend). We're still working on what that would look like...

Hey! Yes, false positives are are a problem that we’re hyper aware of, and a big challenge with most security tools. We have less of a problem with this than other tools for a few reasons :)

1) We're a bit different from a standard fuzzing tool, instead of generating traffic to send to an API we find vulnerabilities by analyzing real production/staging traffic. This gives our models a better understanding of how the API actually works. Although we might add a fuzzer at some point!

2) We split out very high signal vulns (https://demo.metlo.com/vulnerabilities) from vulns/attacks that we detect with our ML models that may have some false positives (https://demo.metlo.com/protection)... Different classifications give you a better way to triage any alerts.

3) We're putting a lot of effort into making our models really good, we're not comfortable with our tool having high false positive rates so when there's a model that is returning 90%+ false positives were aware of that and don't even add it :)

Thanks for the feedback and playing devils advocate!

Here you go! https://backend.metlo.com/deploy/aws?region=us-east-2

Currently we only have AMI's in US Regions, although Metlo should work anywhere... Let me know which region you want to deploy in and I can make an AMI there right away :)

That makes sense... Since we generate specifications for an API automatically, it would be much more efficient (and accurate) than other fuzzing tools :) We'll definitely look into doing that, thank you for the advice!

Yup, there is a button to download at the top right of the spec: https://demo.metlo.com/endpoint/2be9f63e-a436-4ffc-b85a-e421...

Hey @freeqaz! We analyze trace data that we capture from production traffic to generate what the Open API Spec could be.

Here is an example of an auto generated spec: https://demo.metlo.com/endpoint/2be9f63e-a436-4ffc-b85a-e421.... This is the code in our repo: https://github.com/metlo-labs/metlo/blob/master/backend/src/...

To avoid noisy alerts we've tried very hard to focus on areas where we won't have high false positives. Also, unlike ZAP, since we analyze realtime production traffic we have more data to work with so we can make a more informed model. For example we would catch anomalies like high usage on endpoints that return sensitive data, endpoints that normally have authentication that where unauthenticated requests are succeeding, strange ordering of API requests by a single user, etc...