Become a Web Debugging Virtuoso with Fiddler

2. PDC09-CL25 Become a Web Debugging Virtuoso with Fiddler Eric Lawrence Program Manager Microsoft Corporation

3. Fiddler: Origins

4. Once upon a time…

5. Oh no! What happened?!?

6. There must be a better way…

7. Fiddler: Origins

8. Fiddler: Origins

9. Fiddler: Origins

10. Fiddler: Origins +

11. Fiddler: version 1 • The first Fiddler build was released in October 2003.

12. Fiddler: Evolution Six years, ~17k lines of C#, 51+ release builds, and 700+ cans of Diet Mountain Dew later…

13. Fiddler: Today

14. Understanding Extensibility Fiddler 2 Inspector2 ExecAction.exe Inspector2 IFiddlerExtension Your Automation IFiddlerExtension Fiddler ScriptEngine Your FiddlerScript Fiddler Proxy Xceed*.dll Makecert.exe

15. Getting to know Fiddler Demo A quick tour of the Fiddler UI

16. Scenario Traffic Monitoring Browsers, applications, and devices

17. Typical Architecture

18. FiddlerHook for Firefox

19. Debug Across Machines PC Mac Fiddler Internet Linux PocketPC

20. Tips & Tricks • YourApp.exe.config<configuration>  <system.net>    <defaultProxy>      <proxy bypassonlocal="false" usesystemdefault="true" />    </defaultProxy>  </system.net></configuration> • or, use http://ipv4.fiddler

21. Fiddler as a Reverse Proxy

22. HTTPS Traffic Decryption Fiddler dynamically generates interception certificates chained to a self-signed root.

23. Scenario Traffic Archiving Store Requests and Responses

24. Fiddler has many output options • Copy sessions to the clipboard • Store as a plaintext file • Extract binary response bodies • Archive to a database • Export a Visual Studio .WebTest file • Write your own…

25. The SAZ file format Session Archive Zip files contain: • Request and response bytes • Timing and other metadata • HTML index file For security, SAZ files may be encrypted

26. FiddlerCap – Lightweight capture tool http://www.fiddlercap.com

27. Scenario Traffic Analysis Examine Requests and Responses

28. Filtering Traffic • Ignore Images & CONNECTs • Application Type Filter • Process Filter • Using QuickExec • Using Find

29. Spying on IE 8 Accelerators Demo

30. Spying on IE8’s Visual Search Suggestions Demo

31. Traffic Comparison Use WinDiff to compare HTTP requests and responses.

32. Automated (Passive) Analysis http://websecuritytool.codeplex.com/

33. Scenario Traffic Manipulation Change the bytes

34. Automated Rewrites • Simple Built-in Rules • The HOSTS extension

35. Breakpoint Debugging Use Fiddler inspectors to modify requests and responses….

36. Simple Filters • Flag, modify or remove headers from all requests and responses.

37. Request Builder Create hand-built HTTP requests, or modify and reissue a request previously captured.

38. AutoResponder • Replay previously captured or generated traffic.

39. FiddlerScript

40. FiddlerScript – Request Modification staticfunctionOnBeforeRequest(oS:Session){if(oS.uriContains(".aspx")){oS["ui-color"]="red";} if(m_DisableCaching){oS.oRequest.headers.Remove("If-None-Match");oS.oRequest.headers.Remove("If-Modified-Since"); oS.oRequest["Pragma"]="no-cache"; } }

41. FiddlerScript – Response Modification staticfunctionOnBeforeResponse(oS:Session) { oS.utilDecodeResponse();oS.utilPrependToResponseBody("InjectedContent!"); }

42. Scenario Performance Optimizing Performance with Fiddler

43. Build faster websites and services • Reduce request & response size • Reduce roundtrips • Optimize Compression • Optimize Caching • Simulate Slower Speeds

44. Expert Analysis with neXpert

45. Beware the Observer Effect • Use Fiddler to improve performance • Be careful when using Fiddler to measure performance

46. Streaming Mode Timeline view of Buffering Mode Timeline view of Streaming Mode

47. NetMon + VRTA To minimize Observer Effect when taking low-level timing measurements, prefer packet-sniffer tools.

48. Scenario Test Integration Integrating Fiddler into your tools

49. ExecAction.exe • Calls into OnExecActionin script or extensions • Alternatively, invoke directly by sending a Windows Message: oCDS.dwData = 61180; // Magic Cookie oCDS.cbData = strlen(sData); oCDS.lpData = sData; SendMessage( FindWindow(NULL, "Fiddler - HTTP Debugging Proxy"), WM_COPYDATA, NULL, (LPARAM) &oCDS );

50. Fiddler application with extensions Your application hosting FiddlerCore Fiddler 2 YourApp.exe Inspector2 ExecAction.exe Inspector2 IFiddlerExtension IFiddlerExtension Fiddler ScriptEngine Your FiddlerScript FiddlerCore FiddlerCore Xceed*.dll Makecert.exe Makecert.exe