Fiddler and Your Website Robert Boedigheimer

About Me Web developer since 1995 Columnist for aspalliance.com Pluralsight Author 3 rd Degree Black Belt, Tae Kwon Do ASP.NET MVP

HTTP HyperText Transfer Protocol – Request/response paradigm –Header and body

HTTP Request GET HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Referer: Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: devreach.com GET HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Referer: Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: devreach.com

HTTP Response HTTP/ OK Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Vary: Accept-Encoding Server: Microsoft-IIS/7.5 X-AspNet-Version: X-Powered-By: ASP.NET Date: Sun, 23 Sep :11:52 GMT Content-Length: … HTTP/ OK Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Vary: Accept-Encoding Server: Microsoft-IIS/7.5 X-AspNet-Version: X-Powered-By: ASP.NET Date: Sun, 23 Sep :11:52 GMT Content-Length: …

What is Fiddler? Tracing tool built specifically for HTTP Recently acquired by Telerik Eric Lawrence (free) C#

How Does Fiddler Work? Proxy Adjusts browser’s proxy configuration to intercept traffic

Why Use Fiddler? Troubleshoot problems Performance review –Visualize page requests (timeline) Site review Security testing Periodic site reviews Learn how things work

Web Sessions Web Session – single request and response Mark, Comment, Screenshot Properties Compare sessions Search

Decrypt SSL Traffic Fiddler is “Man in the Middle” Off by default, turn on in “Fiddler Options -> HTTPS -> Decrypt HTTPS Traffic”

Filters Can save and load filters Show and hide sessions Block –Images, scripts, CSS Help -> Troubleshoot Filters

Composer How Fiddler got its name… Can “fiddle” with requests –Create manually –Easier to make a request, drag to composer, modify as desired Breakpoints –Interrupt for specific request or response –Opportunity to modify request or response

AutoResponder Since fiddler is a proxy, it can return information without actually contacting the web server Rules –Used in order –Literals, regular expressions, exact matches –Actions Specific status codes Files Other URLs “Unmatched requests passthrough”

Trace Devices Works for devices and platforms where can’t run Fiddler Configure client’s proxy with IP address and port on Windows machine “Reverse Proxy” –

Trace Services Web.config Web Service (.asmx) –.Proxy setting WCF Service –Configure Endpoints

Common Issues Limited processes File -> Capture Traffic No proxy set Browser does not automatically support using “localhost” or “ ” –ipv4.fiddler, ipv6.fiddler

Fiddler Script Intercept and modify traffic JScript.NET Common functions –OnBeforeResponse( ) –OnBeforeRequest( ) –OnExecAction( )

Fiddler Extensions Syntax Highlighting –Color code syntax for HTML, JavaScript, and CSS JavaScript Formatter –Nicely format and un-minify Content Blocker –Use to test what happens if firewall blocked, down, etc Gallery –See thumbnails of all selected sessions that contain images Can write your own

FiddlerCap Non-technical people can perform captures, developer can read in Fiddler –Download and install ( –Step 1, start capture –Step 2, stop capture –Step 3, save capture

Miscellaneous Save raw files Encrypt.saz files Fiddler.exe -viewer archiveName.saz Text Wizard for conversions HTTP Sandbox ( Custom Inspectors Fiddler Core QuickExec

Resources Pluralsight Course – Fiddler – “Debugging with Fiddler: The complete reference from the creator of the Fiddler Web Debugger” Eric Lawrence

Thank blogs.aspadvice.com/robertb Robert Boedigheimer