Download presentation
Presentation is loading. Please wait.
1
Gold Silver Bronze
2
Eric Lawrence @ericlaw Follow along at http://getfiddler.com
3
Origins
4
Once upon a time…
5
Oh no! What happened?!?
6
There must be a better way…
7
A simple idea takes shape… All problems in computer science can be solved by another level of indirection - David Wheeler
8
Fiddler: Evolution Ten years, ~30k lines of C#, 120+ release builds, a cross-country move to Telerik, and two new supported Platforms later…
9
My current side-project
10
New Website New Documentation New Platforms Enhanced User-Interface Roadmap
11
Fiddler Today Demo
12
UI Evolution - Web Sessions list
13
Fiddler on Linux Linux Mint & Ubuntu
14
Fiddler on Mac OSX It works, but due to UI glitches, you’re usually better off using Parallels
15
Traffic Monitoring
16
Typical Architecture
17
Debugging Across Devices Fiddler Mac Internet iOS Phones PC Tablets
18
Fiddler as a Reverse Proxy http://fiddler2.com/r/?reverseproxy
19
Firefox Configuration Use the FiddlerHook add-on or configure Tools > Options > Advanced > Network > Connection Settings > Use system proxy settings
20
Win 8 “Store Apps” & IE11
21
.NET Applications YourApp.exe.config
22
Protocols
23
HTTPS Traffic Decryption Proxies cannot normally “see” HTTPS requests GET /fiddler2/ GET /Fiddler2/Fiddler.css GET /Fiddler/images/FiddlerLogo.png
24
HTTPS Traffic Decryption Fiddler dynamically generates interception certificates chained to a self-signed root.
25
HTML5 WebSockets
26
WebSockets enable bi- directional socket communications over a connection established using HTTP or HTTPS
27
FTP Fiddler supports FTP traffic via a built-in FTP gateway. FTP proxy is off-by-default. Fiddler recognizes and tags SPDY connections if HTTPS-decryption is disabled. SPDY/HTTP2.0
28
Protocol Violation prefs set fiddler.lint.HTTP True
29
Traffic Archiving
30
Fiddler has many output options Copy sessions to the clipboard Store as a plaintext file Extract binary response bodies Archive to a database Export a Visual Studio.WebTest file Build a HTML5 AppCache Manifest Build a WCAT load-test script
31
…or write your own
32
The SAZ file format Session Archive Zip files contain: Request and response bytes Timing and other metadata HTML index file For security, SAZ files may be encrypted
33
FiddlerCap – Lightweight capture tool http://www.fiddlercap.com User-interface localized to: English | Français | Español | Português | 日本語 | русский
34
Traffic Analysis
35
TextWizard Convert text between popular web encodings.
36
Traffic Comparison Use WinDiff or the differ of your choice to compare Sessions’ requests and responses.
37
Traffic Comparison Use the Differ Extension to compare sets of sessions at once.
38
Filtering Traffic Ignore Images & CONNECTs Application Type Filter Process Filter Troubleshooting with Help menu
39
Regular Expression Support
40
SyntaxView Reformatting
41
ImageView DataURL Support
42
ImageView Tools integration
43
ImageView Metadata & GeoLocation
44
Better Together: X-Download-Initiator https://fiddler2.com/dl/EnableDownloadInitiator.reg cols add @request.X-Download-Initiator
45
HTML5 Media & Font previews
46
In Context
47
Internet Explorer F12 Developer tools
48
F12 Developer Tools vs. Fiddler F12 Network TabFiddler Display cache and network requests Display and modify only network requests Shows downloads from current process Shows traffic from all processes Shows post-decryption HTTPS traffic Decrypts HTTPS traffic via “man-in-the-middle” approach ExcellentJavaScript Formatter Less explicit mixed-content detection Exports F12 NetworkData.xmlImports F12 NetworkData.xml
49
Scenario Traffic Manipulation
50
Automated Rewrites Simple built-in Rules The HOSTS command
51
Breakpoint Debugging Use Fiddler Inspectors to modify requests and responses….
52
Simple Filters Flag, modify or remove headers from all requests and responses.
53
Request Composer Create hand-built HTTP requests, or modify and reissue a request previously captured. Supports Automatic authentication File Uploads Redirect chasing Sequential URL Crawling
54
AutoResponder Replay previously- captured or generated traffic.
55
FiddlerScript
56
FiddlerScript – Request Modification static function OnBeforeRequest(oS: Session){ if (oS.uriContains(".aspx")) { oS["ui-color"] = "red"; } if (m_DisableCaching){ oS.oRequest.headers.Remove("If-None-Match"); oS.oRequest.headers.Remove("If-Modified-Since"); oS.oRequest["Pragma"] = "no-cache"; }
57
FiddlerScript – Response Modification static function OnBeforeResponse(oS: Session) { oS.utilDecodeResponse(); oS.utilPrependToResponseBody("Injected Content!"); }
58
Powering up with Extensions
59
Understanding Extensibility Each component in red is your code… Fiddler.exe Fiddler ScriptEngine Inspector2 IFiddlerExtension FiddlerCore ExecAction.exe Your FiddlerScript Xceed*.dllMakecert.exe Script / Batch file
60
Understanding UI Extensibility 1.RulesOptions 2.ToolsActions 3.Custom menus 4.Custom columns 5.ContextActions 6.QuickExec handlers 7.Views 8.Request Inspectors 9.Response Inspectors 10.Import & Export Transcoders
61
Type-specific Inspectors
62
Expert Perf Analysis with neXpert
63
intruder21 Web Fuzzer By yamagata21
64
Watcher & x5s Security Auditors http://websecuritytool.codeplex.com/ http://xss.codeplex.com/
65
WCF Binary Inspector
66
Test Integration
67
ExecAction.exe Calls into OnExecAction in script or extensions Alternatively, invoke directly by sending a Windows Message: oCDS.dwData = 61181; // Magic Cookie oCDS.cbData = lstrlen(wzData * sizeof(WCHAR)); oCDS.lpData = wzData; SendMessage( FindWindow(NULL, "Fiddler - HTTP Debugging Proxy"), WM_COPYDATA, NULL, (LPARAM) &oCDS );
68
Fiddler.exe Fiddler ScriptEngine Inspector2 IFiddlerExtension FiddlerCore ExecAction.exe YourApp.exe FiddlerCore Fiddler application with extensions Your application hosting FiddlerCore Your FiddlerScript Xceed*.dllMakecert.exe CertMaker.dll DotNetZip
69
Programming with FiddlerCore // Call Startup to tell FiddlerCore to begin // listening on the specified port, register as // the system proxy and decrypt HTTPS traffic. Fiddler.FiddlerApplication.Startup(8877, true, true); Fiddler.FiddlerApplication.BeforeResponse += delegate(Fiddler.Session oS) { Console.WriteLine("{0}:HTTP {1} for {2}", oS.id, oS.responseCode, oS.fullUrl); }; // Call Shutdown to tell FiddlerCore to stop // listening and unregister as the system proxy Fiddler.FiddlerApplication.Shutdown();
70
Fiddler Futures Enhanced WebSockets Support .NET 4.5.1 SPDY/HTTP2 You tell me!
71
@ericlaw #fiddler2 //fiddler2.com //fiddlerbook.com Thank you! Now Available
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.