News for hackers. Stuff that matters.

gazorp_

Re:Hetty: An HTTP toolkit for security research on Saturday October 03, 2020 @09:24AM (#24671922)
The MITM proxy feature is comparable to Charles, mitmproxy and others. Typically, in software like OWASP ZAP, Burp Suite (and now Hetty) the MITM proxy is only part of a larger set of features for doing research. E.g. the proxy is used initially for discovery of endpoints, and then the results are used for manual/automated requests/attacks on a service. Hetty doesn't have these features yet, but OWASP ZAP and Burp Proxy do.
Re:Hetty: An HTTP toolkit for security research on Saturday October 03, 2020 @09:19AM (#24671881)
Hi! Hetty author here. I was just experimenting with SQLite as we speak! While I like Cayley so far, I'm already hitting some performance issues when doing full text search/queries that need regex matching on large datasets. Given that HTTP request logging is perfectly suitable for a non-graph database, SQLite is probably more pragmatic. Also, I'm hoping that using a SQLite3 extension for regex (C) will be more performant than using Go's `regexp` package. And of course there's the added benefit you mentioned of a widely used DB with lots of (external) tooling.

The only downsides I see so far are that the project will need cgo, and thus cross compilation is a bit trickier for doing releases on GitHub. But already found a possible tool for making it easier: https://github.com/troian/golang-cross