Burp Suite Pro Alternative

We all familiar with Burp Suite and OWASP ZAP. I have even attended a 3-day training at Singapore back in 2018.

Today, I would like to introduce an alternative to BurpSuitePro. Hetty is an HTTP toolkit for security research that aims to become an open source alternative to Burp Suite Pro. It comes with powerful features tailored to the needs of the infosec and bug bounty community.

Features

• Machine-in-the-middle (MITM) HTTP/1.1 proxy with logs
• Project based database storage (SQLite)
• Scope support
• Headless management API using GraphQL
• Embedded web admin interface (Next.js)

 

Links:

• https://hetty.xyz/guide/
• https://github.com/dstotijn/hetty/
• https://www.zaproxy.org/
  

Mastering Burp Suite Pro

Just completed the training Aug (27~29) on Mastering Burp Suite Pro: 100% Hands-on. 

This is one of the HITB Technical training series by Nicholas Gregoire, one of the best Burp Suite Pro subject matter expert (SME) in the world.

Day 1

• Introduction to Burp: GUI, tools, audit workflow, inline help, …
• Proxy module: scope, filters, sorting, …
• Repeater module: exploitation of the D-Link DIR-100 backdoor, efficiency tips, …
• Intruder module: covering every attack type and most payload types

Day 2

• Advanced Proxy module: live modifications, interception and manual analysis, …
• Sequencer module: token analysis
• Advanced Intruder module: reusing configuration options, non default columns, …
• Auth module: horizontal and vertical privileges escalation

Day 3

• Macros and sessions module: transparent management of anti-CSRF tokens and short sessions
•  Extensions module: catalog of public extensions, developing your own, REST API, …
• Recently added tools: Collaborator, ClickBandit, Infiltrator