Debugging with Fiddler
The complete reference from the creator of the Fiddler Web Debugger
Eric Lawrence
Debugging with Fiddler
Cover Photo: Nicholas Wave; ©IStockPhoto.com/@by_nicholas
Everything else: ©2012 Eric Lawrence. All rights reserved. Please don’t pirate this book in whole or in part. Beyond the nine years
I’ve spent developing Fiddler, I spent nine months on this book and I’d like to be able to pay for the coffee I drank while writing it.
:)
Book Version LULU 1.00 / Fiddler Version 2.3.9.9
Legalese
Trademarks mentioned in this book are (obviously) the property of their respective owners, and are only used to identify the
products or services mentioned.
This book is provided "as is.” In no event shall I, the author, be liable for any consequential, special, incidental or indirect damages
of any kind arising out of the delivery, accuracy, or use of this book. This book was written with care, but no one warrants that it is
error-free. On the contrary, I guarantee that this book contains at least a few errors, and I promise to be suitably embarrassed when
you point them out to me (http://fiddlerbook.com/errata) so that I may update the next version.
e_lawrence@hotmail.com
@ericlaw on Twitter
ii | Introduction
A C K N O W L E D G E M E N T S
This book, and Fiddler itself, would not have been possible without myriad contributions from hundreds of people
around the world.
First, I’d like to thank my wife Jane, a source of inspiration, encouragement, and immense patience as I’ve spent
innumerable nights and weekends working on Fiddler and authoring this book. Next, thanks to my parents and
grandmother, who instilled in me a voracious appetite for books and the idea that one day I should try my hand at
writing one. I beg my friends’ forgiveness for declining so many gatherings over the years to stay home and write
more code.
I’m grateful for the many contributions of colleagues too numerous to mention (they know who they are!), and to the
broader Fiddler community for providing a steady stream of encouragement, suggestions and bug reports. My
colleague Jim Moore warrants a special mention for his careful review of the draft version of this book, and his
valuable feedback on Fiddler over the years. I’d also like to acknowledge the many dozens of donors who supported
Fiddler financially as it became costly to maintain and distribute.
Lastly, I’d like to thank you, dear reader, for caring enough about Fiddler to pick up this book!
iii | Introduction
T A B L E O F C O N T E N T S
Acknowledgements .........................................................................................................................................iii
Table of Contents ............................................................................................................................................. iv
INTRODUCTION ............................................................................................................. 1
Origins .............................................................................................................................................................. 2
About this book............................................................................................................................................ 4
A Quick Primer ................................................................................................................................................. 6
Basic Concepts ............................................................................................................................................. 6
Usage Scenarios ........................................................................................................................................... 7
An Incomplete List of Things Fiddler Can Do ....................................................................................... 7
An Incomplete List of Things Fiddler Cannot Do ................................................................................. 7
EXPLORING FIDDLER ..................................................................................................... 9
Getting Started ................................................................................................................................................ 10
System Requirements ................................................................................................................................ 10
Installing Fiddler........................................................................................................................................ 10
Permissions and XCOPY Deployment ................................................................................................. 10
Updating Fiddler ....................................................................................................................................... 11
Uninstalling Fiddler................................................................................................................................... 11
The Fiddler User-Interface ............................................................................................................................. 12
The Web Sessions List ............................................................................................................................... 12
Understanding Icons and Colors .......................................................................................................... 13
Keyboard Reference .............................................................................................................................. 15
Web Sessions Context Menu ..................................................................................................................... 15
Fiddler’s Main Menu ...................................................................................................................................... 20
The File Menu ............................................................................................................................................ 20
The Edit Menu ........................................................................................................................................... 20
The Rules Menu ......................................................................................................................................... 21
Performance Submenu .......................................................................................................................... 22
The Tools Menu ......................................................................................................................................... 23
The View Menu.......................................................................................................................................... 23
The Help Menu .......................................................................................................................................... 24
Fiddler’s About Box .............................................................................................................................. 25
iv | Introduction
Fiddler’s Toolbar ............................................................................................................................................ 26
Fiddler’s Status Bar .................................................................................................................................... 27
QuickExec ....................................................................................................................................................... 28
QuickExec Selection Commands .......................................................................................................... 28
Default FiddlerScript Commands ........................................................................................................ 30
Application Hotkeys ...................................................................................................................................... 33
Statistics Tab ................................................................................................................................................... 34
The Filters tab ................................................................................................................................................. 36
Hosts ...................................................................................................................................................... 36
Client Process ........................................................................................................................................ 37
Request Headers.................................................................................................................................... 37
Breakpoints ............................................................................................................................................ 38
Response Status Code ........................................................................................................................... 38
Response Type and Size ........................................................................................................................ 39
Response Headers ................................................................................................................................. 39
The Timeline tab ............................................................................................................................................. 40
Mode: Timeline .......................................................................................................................................... 40
Mode: Client Pipe Map .............................................................................................................................. 41
Mode: Server Pipe Map ............................................................................................................................. 42
Using the Timeline for Performance Analysis.......................................................................................... 42
The AutoResponder tab ................................................................................................................................. 43
Specifying the Match Condition ............................................................................................................... 44
Matching Against Request Bodies ........................................................................................................ 45
Specifying the Action Text ........................................................................................................................ 45
Using RegEx Replacements in Action Text .............................................................................................. 46
Drag-and-Drop support ............................................................................................................................ 47
FARX Files .................................................................................................................................................. 48
The TextWizard .............................................................................................................................................. 49
Character Encodings .................................................................................................................................. 50
The Composer tab .......................................................................................................................................... 51
Request Options .................................................................................................................................... 51
Raw Requests ........................................................................................................................................ 52
Parsed Requests ..................................................................................................................................... 52
v | Introduction
Issuing Sequential Requests.................................................................................................................. 52
File Upload Requests ............................................................................................................................ 53
Automatic Request Breakpoints ........................................................................................................... 54
The Log tab ..................................................................................................................................................... 55
The Find Sessions Window ............................................................................................................................ 56
The Host Remapping Tool ............................................................................................................................. 58
TECHNIQUES AND CONCEPTS.......................................................................................59
Retargeting Traffic with Fiddler .................................................................................................................... 60
Method #1 - Rewriting .......................................................................................................................... 60
Method #2 - Rerouting .......................................................................................................................... 60
Method #3 - Redirecting ........................................................................................................................ 61
Features to Retarget Requests ................................................................................................................... 61
Comparing Sessions ....................................................................................................................................... 63
UltraDiff ................................................................................................................................................. 64
Comparing Multiple Sessions at Once ................................................................................................. 64
Debugging with Breakpoints ......................................................................................................................... 65
Setting Breakpoints ............................................................................................................................... 65
Tampering Using Inspectors................................................................................................................. 66
The Breakpoint Bar ................................................................................................................................ 66
Resuming Multiple Sessions ................................................................................................................. 67
CONFIGURING FIDDLER AND CLIENTS .........................................................................69
Fiddler Options............................................................................................................................................... 70
General Options ......................................................................................................................................... 70
HTTPS Options .......................................................................................................................................... 71
Extensions Options .................................................................................................................................... 72
Connections Options ................................................................................................................................. 72
Appearance Options .................................................................................................................................. 74
HeaderEncoding Setting ................................................................................................................................ 75
Preferences ...................................................................................................................................................... 76
Configuring Clients ........................................................................................................................................ 77
Capturing Traffic from Browsers .............................................................................................................. 77
Firefox .................................................................................................................................................... 77
Opera ..................................................................................................................................................... 78
vi | Introduction
Other Browsers ...................................................................................................................................... 78
Capturing Traffic from Other Applications ............................................................................................. 79
WinHTTP ............................................................................................................................................... 79
.NET Framework ................................................................................................................................... 79
Java ......................................................................................................................................................... 80
PHP / CURL ........................................................................................................................................... 81
Capturing Traffic from Services ................................................................................................................ 81
Capturing Traffic to Loopback .................................................................................................................. 81
Loopback Bypasses ............................................................................................................................... 81
Loopback Authentication...................................................................................................................... 82
Loopback Blocked from Metro-style Windows 8 Apps ...................................................................... 82
Running Fiddler on Mac OSX ................................................................................................................... 84
Capturing Traffic from Other Computers ................................................................................................ 85
Capturing Traffic from Devices ................................................................................................................ 86
Apple iOS Proxy Settings ...................................................................................................................... 87
Windows Phone Proxy Settings ........................................................................................................... 87
Windows RT Proxy Settings ................................................................................................................. 88
Other Devices ........................................................................................................................................ 88
Using Fiddler as a Reverse Proxy ............................................................................................................. 88
Acting as a Reverse Proxy for HTTPS .................................................................................................. 89
Chaining to Upstream Proxy Servers ....................................................................................................... 89
Chaining to SOCKS / TOR ......................................................................................................................... 90
VPNs, Modems, and Tethering ................................................................................................................. 91
DirectAccess ............................................................................................................................................... 91
Memory Usage and Fiddler’s Bitness ............................................................................................................ 92
Buffering vs. Streaming Traffic ...................................................................................................................... 94
Request Buffering ...................................................................................................................................... 94
Response Buffering .................................................................................................................................... 94
COMET....................................................................................................................................................... 94
HTML5 WebSockets ....................................................................................................................................... 96
Fiddler and HTTPS ......................................................................................................................................... 98
Trusting the Fiddler Root Certificate ........................................................................................................ 99
Machine-wide Trust on Windows 8 ..................................................................................................... 99
vii | Introduction
Manually Trusting the Fiddler Root ................................................................................................... 100
Additional HTTPS Options ................................................................................................................ 101
Configuring Clients for HTTPS Decryption ................................................................................................ 102
Browsers ................................................................................................................................................... 102
Firefox .................................................................................................................................................. 102
Opera ................................................................................................................................................... 102
Cross-machine scenarios ......................................................................................................................... 102
HTTPS and Devices ................................................................................................................................. 103
Windows Phone .................................................................................................................................. 103
Android and iOS ................................................................................................................................. 103
Buggy HTTPS Servers ............................................................................................................................. 104
Certificate Validation ............................................................................................................................... 105
Certificate Pinning ................................................................................................................................... 105
Fiddler and FTP ............................................................................................................................................ 107
Fiddler and Web Authentication ................................................................................................................. 108
HTTP Authentication .............................................................................................................................. 108
Automatic Authentication in Fiddler ..................................................................................................... 109
Authentication Problems ......................................................................................................................... 110
Channel-Binding ................................................................................................................................. 110
WinHTTP Credential Release Policy .................................................................................................. 110
Loopback Protection ........................................................................................................................... 110
HTTPS Client Certificates ........................................................................................................................ 111
INSPECTORS ................................................................................................................ 113
Overview ...................................................................................................................................................... 114
Auth .............................................................................................................................................................. 116
Caching ......................................................................................................................................................... 118
Cookies .......................................................................................................................................................... 119
Headers ......................................................................................................................................................... 120
Context Menu .......................................................................................................................................... 121
Keyboard Shortcuts ................................................................................................................................. 121
Editing ...................................................................................................................................................... 121
HexView ....................................................................................................................................................... 123
ImageView .................................................................................................................................................... 125
viii | Introduction