The Problem
Security researchers need a lightweight, open‑source MITM proxy that can capture, edit, and replay HTTP traffic without the licensing cost of commercial tools. Existing free options often lack a unified UI, project‑level storage, or easy extensibility.
What This Does
Hetty delivers a full‑stack HTTP toolbox: a Go‑based MITM proxy, a GraphQL API, and a React/Next.js admin UI. The proxy lives in pkg/proxy/ (e.g., proxy.go, intercept/), while request logs and replay logic are in pkg/reqlog/ and pkg/sender/. The UI entry points are under admin/src/pages/ such as index.tsx, projects/index.tsx, and proxy/index.tsx. The Go binary is built from cmd/hetty/main.go, which wires the HTTP server, proxy, and GraphQL layer together.
How To Use It
Setup
Clone and enter repo git clone https://github.com/dstotijn/hetty.git && cd hetty
Build the Go binary (Makefile defines the target)
make build # produces ./hetty (or see Makefile for exact target)
OR use the pre‑built Docker image
docker pull ghcr.io/dstotijn/hetty:latest
Configuration
The binary reads command‑line flags (see cmd/hetty/hetty.go): --cert – path to the root CA certificate (default ~/.hetty/hettycert.pem) --key – path to the private key (default ~/.hetty/hettykey.pem) --db – BoltDB file for projects/logs (default ~/.hetty/hetty.db) --addr – listen address (e.g., 0.0.0.0:8080)
Create a persistent volume for these files if you run via Docker: docker run -v $HOME/.hetty:/root/.hetty -p 8080:8080 ghcr.io/dstotijn/hetty:latest
Running
Local binary ./hetty --addr :8080
Docker (as above) – UI will be reachable at http://localhost:8080
The admin UI is served by the same process; navigate to / for the dashboard, /proxy for live traffic, and /projects for stored sessions.
Real‑World Use
A penetration tester can start Hetty on a workstation, configure their browser to use http://localhost:8080 as an HTTP proxy, and capture all traffic. Using the UI’s Intercept view (admin/src/features/intercept/), they can pause a request, modify headers or body, and replay it. Project tabs (admin/src/features/projects/) let the tester group findings per target, saving logs to ~/.hetty/hetty.db for later analysis or export.
Code Health & Issues
Low – Limited front‑end test coverage – UI components (*.tsx) have no associated test files; potential regressions are unguarded. Medium – Certificate handling – cmd/hetty/cert.go creates files if missing but does not enforce file permissions; a mis‑configured cert could be readable by other users. Low – GraphQL codegen – Generated types live in admin/src/lib/graphql/generated.tsx; regeneration script not documented, making schema updates error‑prone. Low – Dependency hygiene – yarn.lock is present, but no automated dependency‑upgrade workflow; security updates rely on manual PRs. None – Structural health – CI pipelines (.github/workflows/build-test.yml, lint.yml) run go test ./... and npm run lint, tests exist for core Go packages, and a license file is included.
Overall the repository shows disciplined Go module management (go.mod, go.sum), a functional CI pipeline, and a clear separation between back‑end (Go) and front‑end (TSX). The missing UI tests and modest cert handling are the primary gaps.
The Bottom Line
Hetty provides a solid, self‑hosted MITM proxy with a usable web UI and project‑level storage, suitable for individual researchers or small teams that need an open‑source alternative to commercial proxies. It is production‑ready for core proxy functionality, but teams that require rigorous UI testing or hardened certificate management should plan to add those safeguards.