Shulou(Shulou.com)05/31 Report--

This article introduces how to use Hetty to conduct security research audit on HTTP. The content is very detailed. Interested friends can use it for reference. I hope it will be helpful to you.

Hetty

Hetty is a suite of HTTP tools designed for security research that aims to be an open source alternative to commercial software such as BurpSuite Pro. The tool is very powerful and has been customized to meet the needs of information security and vulnerability Hunter community.

The tool currently provides the following features:

Man-in-the-middle attack, which provides a HTTP/1.1 agent with logging

Project-based database storage (SQLite)

Scope support

GraphQL is used to manage API

Embedded Web Interface (js)

It is important to note that the current version of Hetty is still in the early development stage, and more features will be added in later versions.

Tool installation

Hetty compiles the self-contained code, including an embedded SQLite database and an administrator interface based on the Web implementation.

Install the pre-built version (recommended)

The majority of researchers can directly visit the Releases page of the project to download the Hetty of the corresponding operating system platform (supporting Linux, macOS and Windows).

Build from source code

Dependent components:

Go

Yarn

Rice

The functional implementation of Hetty depends on SQLite (mattn/go-sqlite3) and requires cgo to compile. In addition, the static resources of the administrators panel (Next.js) need to be generated through Yarn and embedded in a .go file using go.rice.

Next, clone the project source code locally using the following command, and use the build command to create the project code:

$git clone git@github.com:dstotijn/hetty.git$ cd hetty$ make buildDocker installation

The tool can also be used as a Docker image, and the Docker image of the tool is currently hosted on Docker Hub: dstotijn/hetty.

If you need to persist the CA certificate and the project database, we also need to run the following command to load the volume:

$mkdir-p $HOME/.hetty$ docker run-v $HOME/.hetty:/root/.hetty-p 8080 dstotijn/hetty tool use

After Hetty starts running, port 8080 is listened to by default and can be accessed through http://localhost:8080. Depending on the incoming HTTP request, the tool runs either as a MITM agent or as an API and Web interface.

The default configuration is that the project database and CA certificates will be stored in the .hetty directory under the user's home directory. Linux/macOS corresponds to $HOME,Windows and corresponds to% USERPROFILE%.

Next, make sure that the hetty path is set in the $PATH environment variable, and then run the following command:

$hetty

Here are the help documents and parameter options for the tool:

$hetty-hUsage of. / hetty:-addr string TCP address to listen on, in the form "host:port" (default ": 8080")-adminPath string File path to admin build-cert string CA certificate filepath. Creates a new CA certificate is file doesn't exist (default "~ /. Hetty/hetty_cert.pem")-key string CA private key filepath. Creates a new CA private key if file doesn't exist (default "~ / .hetty/hetty_key.pem")-projects string Projects directory path (default "~ / .hetty / projects")

At this point we will see:

2020-11-01 14:47:10 [INFO] Running server on: 8080...

Next, visit http://localhost:8080.

Certificate configuration and installation

In order for the Hetty agent to send the request to the HTTPS node smoothly, we need to set the root CA certificate for Hetty. In addition, you may need to install CA certificates on the host so that browsers can trust them. The following steps describe how to generate certificates, how to provide them to Hetty, and how to install them in the local CA store.

Generate CA certificate

You can generate CA key pairs in two different ways. The first method is bundled directly with Hetty, greatly simplifying the process. Another way is to use OpenSSL to generate them, so that you can better control the expiration time and the encryption technology used, but you need to install the OpenSSL tool. We suggest beginners to use the first method.

Generate CA certificates using Hetty

When Hetty is first run through the command line tool, it generates a default key and certificate in ~ / .hetty /. Run the command as follows, without any running parameters:

Hetty

At this point we will get ~ / .hetty/hetty_key.pem and ~ / .hetty/hetty_cert.pem, that is, the corresponding keys and certificates.

Generate CA certificates using OpenSSL

We can generate a new key and CA certificate, but they will expire in a month:

Mkdir ~ / .hettyopenssl req-newkey rsa:2048-new-nodes-x509-days 31-keyout ~ / .hetty/hetty_key.pem-out ~ / .hetty/hetty_cert.pem

By default, Hetty will check the key in ~ / .hetty / and the CA certificate, that is, the corresponding hetty_key.pem and hetty_cert.pem. We can move them here manually and Hetty will automatically detect them.

Hetty-key key.pem-cert cert.pem trusts CA certificates

In order for the browser to allow network traffic through the local Hetty proxy, we also need to install these certificates in the local CA store.

In Ubuntu, we can update the local VA store and install the certificate using the following command:

Sudo cp ~ / .hetty/hetty_cert.pem / usr/local/share/ca-certificates/hetty.crtsudo update-ca-certificates

In Windows, you need to use Certificate Manager to add certificates:

Certmgr.msc

Under macOS, we need to use the keychain accessor to add the certificate:

Screenshot of Application/Utilities/Keychain Access.app tool running

On how to use Hetty for HTTP security research audit to share here, I hope that the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.