Solved

How to make proxy settings match between IE and Fiddler2 to decrypt HTTPS traffic

Posted on 2014-01-14
6
1,191 Views
Last Modified: 2014-01-19
I applied Fiddler2 to capture HTTPS traffic one PC within corporate environment successfully. It's IE8 running on Win7. There was no special configuration required to make it work. All the HTTPS traffic data packets were decrypted succeccfully.

However, it was not so well to apply same to the laptop PC, Win 7 + IE10, in my house. No problem to general HTTP. When trying to capture HTTPS traffic, I got proxy error in the begining. I tried to set the connected ISP proxy setting in the "LAN setting", and make sure Fiddler2 did use this proxy settings. There was "Proxy error" until the server/domain of HTTPS communicating with were listed in the "Skip ....." list of decryption list.


How can I make both IE and Fiddler2 match with each other to decrypt HTTPS traffic successfully?
0
Comment
Question by:ChihChieh
  • 4
  • 2
6 Comments
 
LVL 61

Expert Comment

by:btan
ID: 39782058
I thinking of the below and also the key difference is the proxy and the browser version. But always try with cache and cookie cleared first. The 502 error (bad gateway or proxy error) is mostly network error so if browser with fiddler is complaining that it means fiddler is not responding or browser just not even seeing its traffic upstream acknowledged.

(0) Isolate test without ISP proxy instead if possible, e.g. VPN established then try IE10

(1) Tried Chrome which is following IE proxy and see if it also encounter such error. Or try fiddlercap though it may also be using the fiddler2 setting.
@ http://fiddler2.com/fiddlercap/

(2) Every browser allows you to connect a proxy server; usually this is the Options (or Preferences) menu.  You can either point directly at Fiddler (address: 127.0.0.1, port: 8888), or you can use Proxy Auto-configuration. The advantage of auto-configuration is that Fiddler rewrites the configuration script when it is attached and detached, meaning you shouldn't need to manually enable or disable the proxy in your client depending on whether or not Fiddler is loaded.  Simply restart the browser and the new setting is detected. You can get the correct auto-configuration URL from Fiddler by clicking Tools / Fiddler Options / Connections, and clicking the "Copy Browser Proxy Configuration URL" link.

(3) It is not stated in the "known issues"
@ http://www.enhanceie.com/fiddler/help/knownissues.asp

(4) Note that Fiddler does not support upstream proxy configuration scripts that are accessed using the FILE:// protocol, only those accessed using the HTTP or HTTPS protocols
@ http://fiddler2.com/documentation/KnowledgeBase/Proxy
0
 

Author Comment

by:ChihChieh
ID: 39790509
checked with my ISP. There is no proxy server for its clients. Try to point to public external proxy server manualling in Fiddler. It does not work. Could installing a proxy server be an solution?
0
 
LVL 61

Expert Comment

by:btan
ID: 39790528
Wondering if using other browser will work? This is for the sake of isolation to see if ie10 is an issue. If other browser also has the errors likely the https proxy may need an "internal" tier before reaching ISP. that is the same setup as your success case.

Hence we can try doing vpn into internal enterprise lan and try https proxy using ie10 to see if there is any differences. This test will be via the internal proxy.

The challenge is now if all don't work then likely fiddler2 and ie10 combi need more search ...
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 61

Accepted Solution

by:
btan earned 500 total points
ID: 39790568
We also want to make sure there is no other service proxying ssl in the machine. There are some AV that may have such service.  The ie proxy setting should have exception list emptied and set all protocol to go through the same proxy address that work for your http test.

Also the client certificate if needed should be in current user personal certificate store. You can see using certmgr.exe. maybe just have one client cert and not multiple for a start.

Otherwise try other proxy likes Burp suite which is java based
http://portswigger.net/burp/help/suite_gettingstarted.html#browser
0
 

Author Comment

by:ChihChieh
ID: 39791742
I might have found the root cause - Entrust installation running on my PC. What error message displayed on IE distracted the investigation.
There was error message in Fiddler log, "SecureClientPopeDirect failed: The credentials supplied to the package were not recognized on pipe ". Searching all relevant document, and located one had to do with "Entrust", which was installed on my PC. This also matched about ssl service and certificate.
After uninstall Entrust, it worked. Nothing to do with proxy setting, IE version and any others. Just Entrust.

Thanks
0
 
LVL 61

Expert Comment

by:btan
ID: 39791832
thanks for sharing
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

By default, Carbonite Server Backup manages your encryption key for you using Advanced Encryption Standard (AES) 128-bit encryption. If you choose to manage your private encryption key, your backups will be encrypted using AES 256-bit encryption.
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Google currently has a new report that is in beta and coming soon to Webmaster Tool accounts. This Micro Tutorial will highlight new features for Google Webmaster Tools.
How to create a custom search shortcut to site-search Experts Exchange using Google in the Firefox browser. This eliminates the need to type out site:experts-exchange.com whenever you want to search the site. Launch your Bookmark Menu: Press 'Ctrl +…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now