Hetty
A free, open-source web proxy for inspecting and testing HTTP traffic in security work.
- Stars
- 12.5k
- Forks
- 824
- Licence
- MIT
- Language
- Go
- Last update
- 4 months ago
- Type
- App
What it is
Hetty is an HTTP toolkit for security research that sits between your browser and a website as a man-in-the-middle proxy. It logs the requests and responses passing through, lets you search them, intercept and edit traffic before it is sent, and replay or craft requests. The project describes itself as an open-source alternative to commercial tools like Burp Suite Pro.
- Record HTTP traffic from a browser session and search through the logs
- Intercept a request, edit it, then send or cancel it
- Manually create or edit requests with the HTTP client and replay proxied requests
- Limit work to a defined scope and store each project in its own database file
Great for
- Security researchers testing web applications
- Bug bounty hunters who want a free proxy with logging and search
- People who want to inspect and edit intercepted HTTP traffic
- Users comfortable running a local proxy and installing a root CA certificate
Not ideal for
- People looking for a fully polished, feature-complete replacement for Burp Suite Pro: the README says it is under active development and aims to become an alternative
- Anyone testing systems they do not have permission to test, since intercepting traffic raises legal and ethical issues
- Non-technical users who need a point-and-click tool with extensive guided help, since the README points to external docs for setup
How to get it
- 1
Install with a package manager
You'll need: Docker (only if using the Docker option)
macOS (Homebrew)
brew install hettysoft/tap/hettyLinux (Snap)
sudo snap install hettyWindows (Scoop)
scoop bucket add hettysoft https://github.com/hettysoft/scoop-bucket.gitStart Hetty
hetty - 2
Run it
- Install Hetty using the package manager for your OS, or download a release binary from GitHub
- Run `hetty` in a terminal to start the HTTP server and proxy
- Open the web-based admin interface and configure your browser or client to use the proxy
- Use `hetty --chrome` to launch Chrome with proxy settings already applied, per the README's flag description
- 3
Get the most out of it
- Use the --db flag to keep separate project databases for different engagements
- Set scope rules to keep logs focused on the target
- Use the --cert and --key flags to control where the root CA files are stored
- Check the Getting started and docs pages at hetty.xyz for detailed setup
Downloads
Strengths
- Free and MIT-licensed, with source code available on GitHub
- Covers core proxy features: logging, interception, replay and scope in one tool
- Installable through common package managers on macOS, Linux and Windows, or via Docker
Trade-offs
- The README states it is under active development, so features may be incomplete or change
- Documentation is mainly external (hetty.xyz); the README itself gives only brief setup detail
- Intercepting HTTPS requires trusting its root CA certificate, which carries security implications if misused
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| hetty (this) | 12.5k | App | intermediate | 4 months ago | Security researchers testing web applications |
| mitmproxy | 46.6k | Dev tool | intermediate | 4 days ago | Developers debugging how an app talks to a backend API |
| spiderfoot | 24.2k | App | intermediate | 7 months ago | Security professionals doing reconnaissance during penetration tests or red team exercises |
| proxy_pool | 23.8k | App | intermediate | 5 months ago | Developers building web scrapers who want to experiment with rotating proxies |
| ffuf | 17k | CLI | intermediate | 1 months ago | Security testers doing authorized web content discovery |
| httpx | 10.6k | CLI | intermediate | 4 days ago | Security testers doing reconnaissance on lists of hosts they are authorized to test |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.