"How to use fiddler" This presentation will be help you, if you first user about fiddler. Some presentation's page has gammer error then, Please, Email me with feedback, i will fix it quickly. Thanks for your watching writter's email : dydwls121200@gmail.com I'm a student in korea. Exactly There are lots of grammer error. .

1. Let’s use the Fiddler
dydwls121200@gmail.com
YongJin Cho
Happy Hacking!

3. Fiddler...?

4. Web(http)...?

5. It’s Web Debugger !!!

6. It’s Web Debugger !!!

7. Telerik Fiddler
Telerik Fiddler

8. Telerik Fiddler
Telerik Fiddler
D..Damnnnnn!!!

9. (Joke)

10. Let’s start presentation.

12. fiddle [|fɪdl]
①[VERB] If you fiddle with an object, you keep moving it or touching with your fingers
②[VERB] If you fiddle with something, you change it in minor ways.
③[VERB] = If you fiddle with a machine, you adjust it

13. To change it in minor way is the word ‘fiddle’

14. ServerHost
(Capturing)
Clients
Sniff manipulate
HTTP Request HTTP Request
HTTP ResponseHTTP Response
fiddle !!
fiddle !!
fiddle !!
fiddle !!
fiddle !!
fiddle !!
fiddle !!
fiddle !!
fiddle !!
fiddle !!

15. fiddler = freeware for HTTP packet debugger Tool

16. How to appear the Fiddler captured packet

17. List of Request and Response Packets
Information of Request data
Information of response data

18. How to work the Fiddler?

19. Proxy!

20. The Fiddler is be a proxy server on your laptop

21. What is the Proxy?

22. proxy [|prɑːksi]
① [NOUN] If you do something by proxy, you arrange for someone else
to do it for you those attending the meeting may vote by proxy

23. That means some of clients indirectly transport to service server using a
proxy server, It usually use for access the blocked service server
‘cause it can avoid block and surveillance
Client Service Server
directly transport to server
indirectly transport to server
Service ServerProxy Server
Clients
packet

24. Fiddler can manipulate and capture packets. Because, it’s a Proxy Server

25. However,

26. Fiddler follow two rules.
First, Just capture HTTP packets.
Second, All of packets through out the proxy server that fiddler.

27. Description is over.
Now, Let’s install it!

28. Fiddler Install https://www.telerik.com/download/fiddlerDownload Link
Please read next page while downloading.

29. Installation Notice
- It’s web debugging program made by Telerik Co.
- It’s supported Windows, MAC OS, Linux Debian, Fedora
- Fiddler setting up is little hard work on Linux(But Geeks do this thing)
- It’s so easy to use On Windows(Almost setting is auto)
- Almost of Browser setting up is auto, but few of browser isn’t.
License
- This is freeware. Then Telerik never mind occurred error on your PC or service while using this program.
- Fiddler has default option send the data what you did on this program. It’s transport to telerik through anonymous.
if you didn’t want it, change the option yourself.
- This software follows U.S law and rules.
- Fiddler can use for third party.
- If you earn money using manipulated fiddler, Telerik is going to district your illegality. You must be given penalty

30. Fiddler Features
Web Debugging
Performance Test
Record HTTP/HTTPS
Traffic
Manipulate
Web Session
Security Test
Customizing
It can read Cookie, Header, Cache in
http packet, doesn’t matter type of
device(laptop, mobile,PDA, etc..)
Support timeline, occurred http packet’s,
can check service pages weight and
network’s bottle neck.
Easily manipulated web session and Set
up break points.
It’s easy to test application security
about https. It will be helpful.
Fiddler has cool expandability util-
program. Fiddler’s script write on .NET
language. It will be expandable
component.
Fiddler is http proxy debugger. Then, of
course capture https packet and read.

31. If you arrived at this page, your installation be done.
Then, run it !

32. After Installation, Access any web site.
Fiddler is going to capture http packets.

33. If didn’t do that, going to the web browser setting first.

34. Browser Set up
Setting-> Advances Setting-> Change Proxy Settings…. -> LAN setting -> Use a proxy server for …. -> Check!

35. Let’s see fiddler’s user interface

36. List of HTTP Packet
Request of Packet
Response of Packet
Packet Control Menu
Program Control Menu
Service Control Menu
Quick Executor
Status bar

37. Finally

38. Hoped-for Practice

39. After Request page on mobile, Let’s send manipulated request data again.

40. But, you must set up proxy setting on mobile device and PC
(It maybe bored work)

41. Long Click!!
①
②
③
④
⑤
⑥
⑦
Wi-Fi setting -> Long Click SSID -> Modify Network-> Advanced Setting->
Use a proxy setting-> Set up proxy host, port-> Save!

42. “Ah... Um.. did I wrong setting..?”

43. (Or)
“I saw this page!”

44. Nope, You didn’t set it up all
I didn’t told you “access any web site”

45. Program Control Menu-> Tools -> Telerik Fiddler Options...->
“Allow Remote Computers to connect” Check!!

46. Let’s access “http://smartlock.fun25.co.kr” on mobile.

47. “Hum…. This web site is so fat! Why it has *.ttf file?”
( it’s my fault :D )

48. Let’s log-in

49. (This is my private server..
Please, don’t put huge request data. cause’ I’m just a student.)
Test Account
Email : dydwls121200@gmail.com
Password : 1

50. You can see the URI that name ‘/login.do’ and click inspector
Then, you can read request and response data.

51. Do you follow my directions well?

52. Now, Manipulate Request data

53. For manipulating request data, It needs to one process.

54. Breakpoint

55. Fiddler has three way set up to break point.

56. 1. Set up Break point in Program Control Menu
2. Set up Break point on Program’s status bar
3. Scripting on Quick Execute Console(it can directly set up to break point)

57. ①
②
③
- First and Second way are same process. They can
set up break point on request before, response after
- Third way is quick executor short key is ‘Alt+Q’
It move to focus on input box
- Third way’s document
http://docs.telerik.com/fiddler/KnowledgeBase/QuickExec

58. We are developer or major in computer science.
Then, we don’t mind First and Second ways.
Just focus on third way.

59. Press short key[Alt+Q] that quick executor on main display panel.
And enter this command ‘bpu smartlock.fun25.co.kr/dydwls121200@gmail.com’
Short description about Break point commands
-bpu : break point url
-bpafter : break point [response] after
-bpbefore : break point [request] before
Ex) bpu smartlock.fun25.co.kr/dydwls121200@gmail.com

60. Break Pointed web packets
Break Point next Response Data or
Complete to manipulate packet
If you enter any command, display it on this area
Third way’s break point when URI name is smartlock.fun25.co.kr/dydwls121200@gmail.com
Notice !! bpu command is break pointed before transport request data to service server

61. How is it going ? Does packets are stopped by break point well?
Now, Manipulate some request Data.

62. Fill ‘ABCDEFG’ up email input box by Request Data on login Dialog in my practice site,
In addition, you have to modify ‘ABCDEFG’ to ‘dydwls121200@gmail.com’.
Then, you can log-in with ‘dydwls121200@gmail.com’ by manipulating.

63. Type ‘bpu smartlock.fun25.co.kr/login.do’ on quick executor(Press [Alt+Q])
**if you want to release the breakpoint, just execute command ‘bpu’

64. And try to log-in

65. Test Account
Email :ABCDEFG
Password : ABCDEFG
ABCDEFG
● ● ● ● ● ● ●
Log -in

66. If you press‘로그인(log-in)’, fiddler will display
that breakpointed packet about ‘login.do’ on list

67. Modify to
Email : dydwls121200@gmail.com
password : 1.
Then, click ‘Break on Response’
Now, Let’s manipulate request data on ‘login.do’

68. You can receive response data from service server.
We click ‘run to completion’ and release response. ‘Cause don’t need to manipulate

69. Likewise, it can manipulate response data, too.

70. Practice Example is done! Congratulations!

71. “Wait..!!”

72. “How to see wrapped SSL packet? What should I decrypt the documents-!?”

73. Just click them.

74. Like this

75. When you access web service wrapped https

76. Click-!
Check-!
Fiddler is shown yellow box on right panel.

77. If you feel it’s not a smart behavior about decrypt https packet,
Go program control menu -> Tools -> Telerik Fiddler Options…-> Https Tab’
You can change the setting

79. Sometimes, you feel about confusing packet list on left panel

80. What ……

81. 1. I want to see packet from just one service host.
2. I don’t need to capture packets.
3. I want to compare A Host and B Host packets.
4. I want to know the web page’s resource weight

82. Therefore, I prepared several guidelines.

83. 1. I want to see packet from just one service host.
If you want to filter out none-selected host, You would go ‘Filters’ on right panel

84. Documents: http://docs.telerik.com/fiddler/KnowledgeBase/Filters
① 선택형
② 필수
④ 적용
③ 적용
1. Setting up Network’s range.
2. set up hide and show captured packet
3. Write on textarea, want to apply several hosts
4. Following filter this setting execute while
capturing filter

85. 2. I don’t need to capture packets.
There are three way to stop fiddler’s packet capturing
- Click F12
- Check File-> Capture Traffic
- Click Status ‘of Capturing’ On Left of bottom

87. 3. I want to compare A Host and B Host packets.
Select two packet that want to compare.
Then, right click and choose ‘Compare’. Or press ‘[Ctrl+w]’

88. Fiddler has default option that comparing packet need a tool. That’s name ‘WinMerge’.
But, we didn’t have it. then, we have to install it.
(If you install ‘WinMerge’, I recommend you default setting(just click ‘next’ on and on). It hasn’t special)
** Actually, ‘WinMerge’ tool is simple, feather and free, I like it
참고 : http://winmerge.org/

89. After install ‘WinMerge’, press ‘Ctrl+w’ again, compare packets with ‘WinMerge’

90. 4. I want to know the web page’s resource weight
You can check resource loading time and weight with ‘Timeline’ on right panel

91. Select multiple packets on list and click timeline.
It’s done.

92. Thanks for watching, My prepared practices are over!

93. Feedback or question is always welcome.(ㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋ)
Please e-mail me, I will response quickly.
Happy Hacking! > 3<
dydwls121200@gmail.com
YongJin Cho
Translation help YS Park.

94. References
참고 1 : http://www.mehdi-khalili.com/fiddler-in-action/part-1/
참고 2 : http://www.mehdi-khalili.com/fiddler-in-action/part-2/
참고 3 : http://www.telerik.com/fiddler/add-ons [Fiddler extension program]
참고 4 : https://www.youtube.com/watch?v=8bo5kXMAcV0 [Fiddler Official Video]
참고 5 : http://winmerge.org/ [WinMerge Office Web]