Hetty: An HTTP toolkit for security research | Hacker News Reader

Hetty: An HTTP toolkit for security research

github.com

108 pointsoedmarap10 comments

This looks like a fantastic project that I've been waiting for for years! Burp Suite was my go to for a long time. Even when I left security and moved to development, I still use it occasionally for troubleshooting.

An intercepting proxy is a great tool for any web developer in addition to security research, and it's awesome to see an open source option.

There's been an open source option for 10 years - ZAP :)

But seriously, have you ever tried zap against burp? Like all owasp projects, the idea is awesome and there is an excellent community behind it but the execution stopped being anything useful years ago. I really think owasp and ‘free’ are what gives zap it’s base. But a base isn’t the same as relevant.

Burp is with all it’s faults is still so much better in every aspect. If you just discard any technical feature, just the workflow from start to finish shows zap being build BY developers and burp being build FOR hackers. This alone explains why every serious security professional you will ever meet will swear to burp. This doesn’t mean that there is no usecase of course. It’s probably still relevant in the training area and it is included as an ‘automated’ dast/scanner in many cicd pipelines for cheap and preventing low-hanging fruit.

Hetty looks promising so far and competition will drive the overall quality of this niche.

Looks similar to MITMproxy, not sure what the bonus security-related parts are.

If Cayley doesn't work out I hope you'll consider SQLite - same benefits (easily packaged in the single binary) but it would make it super easy for people like myself to do fun things with the underlying database.

Hi! Hetty author here. I was just experimenting with SQLite as we speak! While I like Cayley so far, I'm already hitting some performance issues when doing full text search/queries that need regex matching on large datasets. Given that HTTP request logging is perfectly suitable for a non-graph database, SQLite is probably more pragmatic. Also, I'm hoping that using a SQLite3 extension for regex (C) will be more performant than using Go's `regexp` package. And of course there's the added benefit you mentioned of a widely used DB with lots of (external) tooling.

The only downsides I see so far are that the project will need cgo, and thus cross compilation is a bit trickier for doing releases on GitHub. But already found a possible tool for making it easier: https://github.com/troian/golang-cross

This would be fun at work to find most hit uri, slowest url and the like.

Logging on the a back end is fine but this would be simpler I think.

Is it an alternative to Charles?

The MITM proxy feature is comparable to Charles, mitmproxy and others. Typically, in software like OWASP ZAP, Burp Suite (and now Hetty) the MITM proxy is only part of a larger set of features for doing research. E.g. the proxy is used initially for discovery of endpoints, and then the results are used for manual/automated requests/attacks on a service. Hetty doesn't have these features yet, but OWASP ZAP and Burp Proxy do.

How does it compare with pappy proxy?

Reply on news.ycombinator.com