Solved

How to make proxy settings match between IE and Fiddler2 to decrypt HTTPS traffic

Posted on 2014-01-14
6
1,198 Views
Last Modified: 2014-01-19
I applied Fiddler2 to capture HTTPS traffic one PC within corporate environment successfully. It's IE8 running on Win7. There was no special configuration required to make it work. All the HTTPS traffic data packets were decrypted succeccfully.

However, it was not so well to apply same to the laptop PC, Win 7 + IE10, in my house. No problem to general HTTP. When trying to capture HTTPS traffic, I got proxy error in the begining. I tried to set the connected ISP proxy setting in the "LAN setting", and make sure Fiddler2 did use this proxy settings. There was "Proxy error" until the server/domain of HTTPS communicating with were listed in the "Skip ....." list of decryption list.


How can I make both IE and Fiddler2 match with each other to decrypt HTTPS traffic successfully?
0
Comment
Question by:ChihChieh
  • 4
  • 2
6 Comments
 
LVL 62

Expert Comment

by:btan
ID: 39782058
I thinking of the below and also the key difference is the proxy and the browser version. But always try with cache and cookie cleared first. The 502 error (bad gateway or proxy error) is mostly network error so if browser with fiddler is complaining that it means fiddler is not responding or browser just not even seeing its traffic upstream acknowledged.

(0) Isolate test without ISP proxy instead if possible, e.g. VPN established then try IE10

(1) Tried Chrome which is following IE proxy and see if it also encounter such error. Or try fiddlercap though it may also be using the fiddler2 setting.
@ http://fiddler2.com/fiddlercap/

(2) Every browser allows you to connect a proxy server; usually this is the Options (or Preferences) menu.  You can either point directly at Fiddler (address: 127.0.0.1, port: 8888), or you can use Proxy Auto-configuration. The advantage of auto-configuration is that Fiddler rewrites the configuration script when it is attached and detached, meaning you shouldn't need to manually enable or disable the proxy in your client depending on whether or not Fiddler is loaded.  Simply restart the browser and the new setting is detected. You can get the correct auto-configuration URL from Fiddler by clicking Tools / Fiddler Options / Connections, and clicking the "Copy Browser Proxy Configuration URL" link.

(3) It is not stated in the "known issues"
@ http://www.enhanceie.com/fiddler/help/knownissues.asp

(4) Note that Fiddler does not support upstream proxy configuration scripts that are accessed using the FILE:// protocol, only those accessed using the HTTP or HTTPS protocols
@ http://fiddler2.com/documentation/KnowledgeBase/Proxy
0
 

Author Comment

by:ChihChieh
ID: 39790509
checked with my ISP. There is no proxy server for its clients. Try to point to public external proxy server manualling in Fiddler. It does not work. Could installing a proxy server be an solution?
0
 
LVL 62

Expert Comment

by:btan
ID: 39790528
Wondering if using other browser will work? This is for the sake of isolation to see if ie10 is an issue. If other browser also has the errors likely the https proxy may need an "internal" tier before reaching ISP. that is the same setup as your success case.

Hence we can try doing vpn into internal enterprise lan and try https proxy using ie10 to see if there is any differences. This test will be via the internal proxy.

The challenge is now if all don't work then likely fiddler2 and ie10 combi need more search ...
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 
LVL 62

Accepted Solution

by:
btan earned 500 total points
ID: 39790568
We also want to make sure there is no other service proxying ssl in the machine. There are some AV that may have such service.  The ie proxy setting should have exception list emptied and set all protocol to go through the same proxy address that work for your http test.

Also the client certificate if needed should be in current user personal certificate store. You can see using certmgr.exe. maybe just have one client cert and not multiple for a start.

Otherwise try other proxy likes Burp suite which is java based
http://portswigger.net/burp/help/suite_gettingstarted.html#browser
0
 

Author Comment

by:ChihChieh
ID: 39791742
I might have found the root cause - Entrust installation running on my PC. What error message displayed on IE distracted the investigation.
There was error message in Fiddler log, "SecureClientPopeDirect failed: The credentials supplied to the package were not recognized on pipe ". Searching all relevant document, and located one had to do with "Entrust", which was installed on my PC. This also matched about ssl service and certificate.
After uninstall Entrust, it worked. Nothing to do with proxy setting, IE version and any others. Just Entrust.

Thanks
0
 
LVL 62

Expert Comment

by:btan
ID: 39791832
thanks for sharing
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Explore the encryption capabilities built into Google Apps and how these features can help you meet privacy policy and regulatory compliance, but are not a full solution. Understand and compare the most popular email encryption services for Google A…
Healthcare providers, insurance companies and other covered entities trust eFax Corporate to transmit their most sensitive documents. eFax Corporate can help your organization implement a HIPAA compliant cloud faxing solution.
How to create a custom search shortcut to site-search Experts Exchange using Google in the Firefox browser. This eliminates the need to type out site:experts-exchange.com whenever you want to search the site. Launch your Bookmark Menu: Press 'Ctrl +…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

943 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now