12

I have the following situation: 2 hosts, one is a client and the other an HTTPS server.

Client (:<brwsr-port>) <=============> Web server (:443)

I installed Fiddler on the server so that I now have Fiddler running on my server on port 8888.

The situation i would like to reach is the following:

|Client (:<brwsr-port>)| <===> |Fiddler (:8888) <===> Web server (:443)|
|-Me-------------------|       |-Server--------------------------------|

From my computer I want to contact Fiddler which will redirect traffic to the web server. The web server however uses HTTPS.

On The server I set up Fiddler to handle HTTPS sessions and decrypt them. I was asked to install on the server Fiddler's fake CA's certificate and I did it! I also inserted the script suggested by the Fiddler wiki page to redirect HTTPS traffic

// HTTPS redirect ----------------------- 
FiddlerObject.log("Connect received...");
if (oSession.HTTPMethodIs("CONNECT") && (oSession.PathAndQuery == "<server-addr>:8888")) {
    oSession.PathAndQuery = "<server-addr>:443";
}
// --------------------------------------

However when I try https://myserver:8888/index.html I fail!

Failure details

When using Fiddler on the client, I can see that the CONNECT request starts but the session fails because response is HTTP error 502. Looks like no one is listening on port 8888. In fact, If I stop Fiddler on the server I get the same situation: 502 bad gateway.

Please note that when I try https://myserver/index.html and https://myserver:443/index.html everything works!

Question

What am I doing wrong?

Is it possible that...?

I thought that since maybe TLS/SSL works on port 443, I should have Fiddler listen there and move my web server to another port, like 444 (I should probably set on IIS an https binding on port 444 then). Is it correct?

Community
  • 1
  • 1
Andry
  • 16,172
  • 27
  • 138
  • 246

2 Answers2

20

If Fiddler isn't configured as the client's proxy and is instead running as a reverse proxy on the Server, then things get a bit more complicated.

Running Fiddler as a Reverse Proxy for HTTPS

  1. Move your existing HTTPS server to a new port (e.g. 444)
  2. Inside Tools > Fiddler Options > Connections, tick Allow Remote Clients to Connect. Restart Fiddler.
  3. Inside Fiddler's QuickExec box, type !listen 443 ServerName where ServerName is whatever the server's hostname is; for instance, for https://Fuzzle/ you would use fuzzle for the server name.

  4. Inside your OnBeforeRequest method, add:

    if ((oSession.HostnameIs("fuzzle")) &&
    (oSession.oRequest.pipeClient.LocalPort == 443) ) 
{
   oSession.host = "fuzzle:444";
}

Why do you need to do it this way?

The !listen command instructs Fiddler to create a new endpoint that will perform a HTTPS handshake with the client upon connection; the default proxy endpoint doesn't do that because when a proxy receives a connection for HTTPS traffic it gets a HTTP CONNECT request instead of a handshake.

Cyril Durand
  • 15,834
  • 5
  • 54
  • 62
EricLaw
  • 56,563
  • 7
  • 151
  • 196
  • 1
    BTW, how to start HTTPS listener with an existing certificate (not issued by FIDDLER_DO_NOT_TRUST)? I tried to bind certificate by `netsh http add sslcert` but it does not affect on this. – greatvovan Mar 06 '15 at 09:08
  • Thank you for the information and answer improvement. Concerning questions, did you read this? http://stackoverflow.com/questions/28850330/running-fiddler-as-http-to-https-reverse-proxy Is it possible at all? – greatvovan Mar 07 '15 at 19:51
  • 2
    Worked for me, the only small adjustment - host lowercase. – username Apr 29 '16 at 16:31
  • @EricLaw I have added the onbeforeRequest with `oSession.host = "mywebapi.dev:444";` but when I enter the `!listen 443 mywebapi.dev` I get `Port 443 is in use by system:4. Would you like Fiddler to use a random port`. `A secure listener is started on #443` with certificate `SubjectCN=mywebapi.dev`. If I click yes it does not work. I am using Fiddler 4.6.2.3. Browser and Server are on the same machine in my case! – Legends Jun 06 '16 at 21:30
2

I just ran into a similar situation where I have VS2013 (IISExpress) running a web application on HTTPS (port 44300) and I wanted to browse the application from a mobile device.

I configured Fiddler to "act as a reverse proxy" and "allow remote clients to connect" but it would only work on port 80 (HTTP).

Following on from EricLaw's suggestion, I changed the listening port from 8888 to 8889 and ran the command "!listen 8889 [host_machine_name]" and bingo I was able to browse my application on HTTPS on port 8889.

Note: I had previously entered the forwarding port number into the registry (as described here) so Fiddler already knew what port to forward the requests on to.

Raj Parmar
  • 981
  • 1
  • 10
  • 13