4 ms·

Hetty: An HTTP toolkit for security research

108 points by oedmarap 6y ago

freedomben 6y ago
This looks like a fantastic project that I've been waiting for for years! Burp Suite was my go to for a long time. Even when I left security and moved to development, I still use it occasionally for troubleshooting. An intercepting proxy is a great tool for any web developer in addition to security research, and it's awesome to see an open source option.
- psiinon 6y ago
  There's been an open source option for 10 years - ZAP :)
  - bittencourtVFX 6y ago
    But seriously, have you ever tried zap against burp? Like all owasp projects, the idea is awesome and there is an excellent community behind it but the execution stopped being anything useful years ago. I really think owasp and ‘free’ are what gives zap it’s base. But a base isn’t the same as relevant. Burp is with all it’s faults is still so much better in every aspect. If you just discard any technical feature, just the workflow from start to finish shows zap being build BY developers and burp being build FOR hackers. This alone explains why every serious security professional you will ever meet will swear to burp. This doesn’t mean that there is no usecase of course. It’s probably still relevant in the training area and it is included as an ‘automated’ dast/scanner in many cicd pipelines for cheap and preventing low-hanging fruit. Hetty looks promising so far and competition will drive the overall quality of this niche.
simonw 6y ago
If Cayley doesn't work out I hope you'll consider SQLite - same benefits (easily packaged in the single binary) but it would make it super easy for people like myself to do fun things with the underlying database.
- vorticalbox 6y ago
  This would be fun at work to find most hit uri, slowest url and the like. Logging on the a back end is fine but this would be simpler I think.
- gazorp_ 6y ago
  Hi! Hetty author here. I was just experimenting with SQLite as we speak! While I like Cayley so far, I'm already hitting some performance issues when doing full text search/queries that need regex matching on large datasets. Given that HTTP request logging is perfectly suitable for a non-graph database, SQLite is probably more pragmatic. Also, I'm hoping that using a SQLite3 extension for regex (C) will be more performant than using Go's `regexp` package. And of course there's the added benefit you mentioned of a widely used DB with lots of (external) tooling. The only downsides I see so far are that the project will need cgo, and thus cross compilation is a bit trickier for doing releases on GitHub. But already found a possible tool for making it easier: https://github.com/troian/golang-cross https://github.com/troian/golang-cross
nick238 6y ago
Looks similar to MITMproxy, not sure what the bonus security-related parts are.
baby 6y ago
How does it compare with pappy proxy?
moltar 6y ago
Is it an alternative to Charles?
- gazorp_ 6y ago
  The MITM proxy feature is comparable to Charles, mitmproxy and others. Typically, in software like OWASP ZAP, Burp Suite (and now Hetty) the MITM proxy is only part of a larger set of features for doing research. E.g. the proxy is used initially for discovery of endpoints, and then the results are used for manual/automated requests/attacks on a service. Hetty doesn't have these features yet, but OWASP ZAP and Burp Proxy do.

108 points by oedmarap 6y ago

This looks like a fantastic project that I've been waiting for for years! Burp Suite was my go to for a long time. Even when I left security and moved to development, I still use it occasionally for troubleshooting. An intercepting proxy is a great tool for any web developer in addition to security research, and it's awesome to see an open source option.

psiinon 6y ago
There's been an open source option for 10 years - ZAP :)
- bittencourtVFX 6y ago
  But seriously, have you ever tried zap against burp? Like all owasp projects, the idea is awesome and there is an excellent community behind it but the execution stopped being anything useful years ago. I really think owasp and ‘free’ are what gives zap it’s base. But a base isn’t the same as relevant. Burp is with all it’s faults is still so much better in every aspect. If you just discard any technical feature, just the workflow from start to finish shows zap being build BY developers and burp being build FOR hackers. This alone explains why every serious security professional you will ever meet will swear to burp. This doesn’t mean that there is no usecase of course. It’s probably still relevant in the training area and it is included as an ‘automated’ dast/scanner in many cicd pipelines for cheap and preventing low-hanging fruit. Hetty looks promising so far and competition will drive the overall quality of this niche.

simonw 6y ago

If Cayley doesn't work out I hope you'll consider SQLite - same benefits (easily packaged in the single binary) but it would make it super easy for people like myself to do fun things with the underlying database.

vorticalbox 6y ago
This would be fun at work to find most hit uri, slowest url and the like. Logging on the a back end is fine but this would be simpler I think.
gazorp_ 6y ago
Hi! Hetty author here. I was just experimenting with SQLite as we speak! While I like Cayley so far, I'm already hitting some performance issues when doing full text search/queries that need regex matching on large datasets. Given that HTTP request logging is perfectly suitable for a non-graph database, SQLite is probably more pragmatic. Also, I'm hoping that using a SQLite3 extension for regex (C) will be more performant than using Go's `regexp` package. And of course there's the added benefit you mentioned of a widely used DB with lots of (external) tooling. The only downsides I see so far are that the project will need cgo, and thus cross compilation is a bit trickier for doing releases on GitHub. But already found a possible tool for making it easier: https://github.com/troian/golang-cross https://github.com/troian/golang-cross

nick238 6y ago

Looks similar to MITMproxy, not sure what the bonus security-related parts are.

baby 6y ago

How does it compare with pappy proxy?

moltar 6y ago

Is it an alternative to Charles?

gazorp_ 6y ago
The MITM proxy feature is comparable to Charles, mitmproxy and others. Typically, in software like OWASP ZAP, Burp Suite (and now Hetty) the MITM proxy is only part of a larger set of features for doing research. E.g. the proxy is used initially for discovery of endpoints, and then the results are used for manual/automated requests/attacks on a service. Hetty doesn't have these features yet, but OWASP ZAP and Burp Proxy do.