How FiddlerCore Decrypts HTTPS Traffic

Question

I wrote a small program to capture https traffic. I want to capture DECODED to receive and publish data using this software.
As you know, a Fiddler application can do this like a charm, and now I'm looking for a way to do this in my program.

For example, here is my code:

void FiddlerApplication_AfterSessionComplete(Fiddler.Session oSession) { this.Invoke(new MethodInvoker(delegate { oSession.bBufferResponse = true; txtLog.Text += "full-url : \r\n" + oSession.fullUrl.ToString() + "\r\n-----------------------------------------------\r\n"; txtLog.Text += "method : \r\n" + oSession.oRequest.headers.HTTPMethod + "\r\n-----------------------------------------------\r\n"; txtLog.Text += "request headers : \r\n" + oSession.oRequest.headers + "\r\n-----------------------------------------------\r\n"; txtLog.Text += "responce headers : \r\n" + oSession.oResponse.headers + "\r\n-----------------------------------------------\r\n"; txtLog.Text += "get request body as string : \r\n" + oSession.GetRequestBodyAsString() + "\r\n-----------------------------------------------\r\n"; txtLog.Text += "request body bytes : \r\n" + oSession.requestBodyBytes + "\r\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n"; txtLog.SelectionStart = txtLog.Text.Length; txtLog.ScrollToCaret(); })); } 

and get request body as string in txtLog for the https web page, as shown below:

 get request body as string : A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below. Major Version: 3 Minor Version: 1 Random: 52 02 18 75 64 2D 8D 65 75 B9 C4 1B 58 76 92 3E 6B C5 BF 1D 3B D4 53 5D D2 FA CA D8 BF CE 02 5D SessionID: empty Ciphers: [002F] TLS_RSA_AES_128_SHA 

What is this handshake side and how can I decode it? as you know, there are two files (TrustCert.exe and makecert.exe) inside the installed violinist application.
What are these files and can I use them in my small application to decode data? as?

early

Answer 1

The FiddlerCore class library decrypts HTTPS traffic using the man-in-the-middle approach.

As discussed in the Fiddler Book :

The HTTPS protocol sandwich encrypted (SSL or TLS) connection between HTTP requests and the underlying TCP / IP network connection over which these requests are sent. Network intermediaries or in this way, observers cannot view or modify HTTP traffic due to the use of cryptographic protocols. You might be surprised to learn that Fiddler can view and change HTTPS traffic if it is configured accordingly. The violinist accomplishes this using a man-in-the-middle approach to HTTPS, which means that when talking to a client, he pretends to be a server, and when he talks to a server, he pretends to be a client.

The HTTPS protocol is explicitly designed to block this attack using digital certificates to authenticate the identifier of the HTTPS server (and, if necessary, the client). When the client receives the certificate from the server, it confirms that the certificate itself is trustworthy whether it is connected to the Root Certification Authority, which the client or the operating system trusts. Since you typically run Fiddler on your own computer, you can reconfigure your browser or operating system to trust the Fiddlers root certificate. After you therefore, the client application will not complain when it detects that the traffic is protected by certificates generated by Fiddler.

If your goal is to incorporate this feature into your application, you should simply use FiddlerCore in your application - that’s why it exists!

As for your “handshake” question - a handshake is how the client and server agree on the parameters for HTTPS exchange (for example, which cipher and keys to use). You don't "decode" the handshake one at a time ... FiddlerCore handles this for you.

You may be confused because HTTPS traffic is running in the HTTP CONNECT tunnel, and this tunnel is also displayed in FiddlerCore. To ensure that your HTTPS sessions are also captured, be sure to pass the FiddlerCoreStartupFlags.DecryptSSL flag when calling the Startup method. Also, make sure makecert.exe is in the same folder as the executable program.

Also, keep in mind that setting the bBufferResponse property after a processing session has no effect; you must delete this.