Skip to content

Back to the catalog

Hetty
github.comrepo

Hetty

Hetty is an open-source HTTP toolkit for security research written to be a free alternative to Burp Suite Pro, aimed at infosec and bug bounty practitioners. It provides a machine-in-the-middle HTTP proxy with searchable logs, a manual HTTP client for crafting/editing/replaying requests, request/response interception for manual review, project-based scoping, and a web-based admin UI backed by a GraphQL API, distributed via Homebrew, Scoop, Snap, and Docker.

TL;DR Open-source Burp Suite Pro alternative: MITM proxy, request interception/replay, and scoped project storage via a web admin UI.
Open original ↗
Document

What it is

Hetty is a single-binary HTTP proxy and web admin UI for security testing. The page positions it as an open source alternative to Burp Suite Pro and says it is under active development, with status tracked in the backlog. Copyright runs 2019 to 2025 under Hetty Software.

What to do

Install through a package manager:

brew install hettysoft/tap/hetty
sudo snap install hetty
scoop bucket add hettysoft https://github.com/hettysoft/scoop-bucket.git
scoop install hettysoft/hetty

Or download a release binary from GitHub and put it in a directory on $PATH. Compiling from source is listed as "link coming soon", so there are no source build instructions on the page.

To run with Docker, mounting the database and certificate directory and forwarding port 8080:

docker run -v $HOME/.hetty:/root/.hetty -p 8080:8080 \
  ghcr.io/dstotijn/hetty:latest

Images are also on Docker Hub. Start the native binary with hetty. Then point the browser at the proxy and trust the generated root CA, or use --chrome, which launches Chrome with proxy settings applied and certificate errors ignored.

Flags and defaults from hetty --help:

FlagDefaultPurpose
--cert~/.hetty/hetty_cert.pemRoot CA certificate, created if missing
--key~/.hetty/hetty_key.pemRoot CA private key, created if missing
--db~/.hetty/hetty.dbDatabase file, created if missing
--addr:8080Listen address as host:port
--chromefalseLaunch preconfigured Chrome
--verbose, --jsonoffVerbose logs, JSON-encoded logs

There is one subcommand, cert, for certificate management. Run hetty <subcommand> --help for its options.

Caveats

  • The root CA private key is written to disk in plain files at the default path. Anyone who gets that key can sign certificates for any site that trusts the CA, so restrict access to ~/.hetty and keep the CA out of your everyday browser profile.
  • The default --addr is :8080 with no host. The page does not say which interfaces that binds, so check with --addr set explicitly (for example to a loopback address) before running on a shared network. The same applies to the admin UI and GraphQL API served by the same process.
  • The page gives no feature comparison with Burp Suite Pro, no version numbers and no performance data. The feature list is proxy with search, request editor and replay, interception, scope, and project-based storage.
  • Support goes through GitHub issues, discussions and a Discord server. The page also carries a survey request for professional pen testing teams.

Technologies named here

Related in Offensive Security