AwesomeREA.org

Tool

Hetty

Open-source HTTP toolkit for security research, which its author aims to make an alternative to Burp Suite Pro. A single Go binary runs a machine-in-the-middle HTTP proxy backed by its own generated root CA, logs proxied requests and responses in per-project databases with search filters and scope rules, and serves a web admin interface. From that interface an analyst can hold requests and responses for manual review, then edit, forward or cancel them, or copy logged requests into a Sender module to edit and resend them.

Targets
Website
Category
Website analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v0.7.0, published 2022-03-29, with Linux, macOS and Windows builds for x86_64 and arm64; the README also lists Homebrew, snap and Scoop packages and Docker images. The reviewed main commit (2026-06-27) is 14 commits ahead of that release, among them the January 2025 switch from BadgerDB to a single bbolt database file (by default hetty.db in the .hetty folder of the user's home directory). The hetty.xyz getting-started guide still describes the older BadgerDB directory. The README says Hetty is under active development.
  • Run hetty, open the admin interface on port 8080 and create a project; only then are proxied requests logged. By default the server listens on all interfaces (:8080). On first start Hetty creates a root CA certificate and private key in that .hetty folder. To inspect HTTPS from their own browser, analysts trust that CA (hetty cert install adds it to the system trust store, and optionally to Firefox and Java) or use --chrome, which launches Chrome with the proxy settings applied and certificate errors ignored. Hetty logs only traffic from clients the analyst points at the proxy; the docs recommend the --chrome profile or a browser proxy extension over system-wide proxy settings.
  • Source builds need Go 1.23 and Yarn: the Makefile builds the Next.js admin interface and embeds it into the Go binary with CGO disabled. The README's link to source-build instructions is still marked as coming soon.
  • MIT license (© 2019–2025 Hetty Software). The README's feature list covers proxy logs with search, the request sender, interception, scope and project storage. Nothing was installed and no traffic was proxied.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · dstotijn/hetty · Revision 8ca6b07
  2. cmd/hetty/hetty.go GitHub · dstotijn/hetty · Revision 8ca6b07
  3. cmd/hetty/cert.go#L13-L45 GitHub · dstotijn/hetty · Revision 8ca6b07
  4. pkg/proxy/intercept GitHub · dstotijn/hetty · Revision 8ca6b07
  5. pkg/filter GitHub · dstotijn/hetty · Revision 8ca6b07
  6. Makefile GitHub · dstotijn/hetty · Revision 8ca6b07
  7. go.mod GitHub · dstotijn/hetty · Revision 8ca6b07
  8. LICENSE GitHub · dstotijn/hetty · Revision 8ca6b07
  9. https://github.com/dstotijn/hetty/commit/fcf0e1c51ebbb6ea0cfb1056164ff75bc056685f
  10. https://github.com/dstotijn/hetty/releases/tag/v0.7.0
  11. https://hetty.xyz/docs/getting-started
  12. https://hetty.xyz/docs/guides/intercept

More in Websites

All 48 entries in Websites