Fiddler not capturing HTTPS traffic to a specific website

1,098 views
Skip to first unread message

Tony

unread,
Aug 4, 2009, 11:25:06 AM8/4/09
to Fiddler
I am using Fiddler v2.2.4.1 to capture traffic to a secure website.
The company uses a proxy that requires authentication and Fiddler is
setup to chain to the upstream proxy. This is working fine for almost
everything I do, except for the web app I must test :-(

I am getting HTTP/1.1 407 Proxy Authentication Required for the TTE
but everything works if I https to other sites, i.e. https://www.microsoft.com.

This is the Fiddler session:
GET /login.aspx?ReturnUrl=%2fdefault.aspx HTTP/1.1
Accept: */*
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (...)
Host: www.myWebsite.net
Proxy-Connection: Keep-Alive

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: NEGOTIATE
Proxy-Authenticate: NTLM
Proxy-Authenticate: BASIC realm="xxx_AD"
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Proxy-Connection: close
Set-Cookie: ...; Path=/
Connection: close
Content-Length: 1076
Proxy-Support: Session-Based-Authentication

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
...
</BODY></HTML>

------------------------------------------------------------------
GET /login.aspx?ReturnUrl=%2fdefault.aspx HTTP/1.1
Accept: */*
Accept-Language: en-us
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (...)
Cookie: ...
Proxy-Connection: Keep-Alive
Host: www.myWebsite.net
Proxy-Authorization: Negotiate TlRMTVNTUAA...tRDFSRVNMRU4=


HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: NEGOTIATE TlRMTVNTUAACA...MALgBjAG8AbQAAAAAA
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Proxy-Connection: Keep-Alive
Set-Cookie: ...
Connection: Keep-Alive
Content-Length: 1093
Proxy-Support: Session-Based-Authentication

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
...
</BODY></HTML>

------------------------------------------------------------------
GET /login.aspx?ReturnUrl=%2fdefault.aspx HTTP/1.1
Accept: */*
Accept-Language: en-us
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (...)
Cookie: ...
Proxy-Connection: Keep-Alive
Proxy-Authorization: Negotiate
TlRMTVNTUAADAAAAGAAYAI4....JOidfuuoSfQ==
Host: www.myWebsite.net


HTTP/1.1 200 OK
Content-Type: text/html
Content-Location: http://www.myWebsite.net/default.htm?403;http://www.myWebsite.net:80/login.aspx?ReturnUrl=%2fdefault.aspx
Last-Modified: Fri, 10 Jul 2009 21:13:24 GMT
Accept-Ranges: bytes
ETag: ...
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 04 Aug 2009 14:39:47 GMT
Content-Length: 239
Proxy-Connection: Keep-Alive
Connection: Keep-Alive
Age: 0

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>Your Page Title</title>
<meta http-equiv="REFRESH" content="0;url=https://www.myWebsite.net/
default.aspx"></HEAD>
<BODY>
...
</BODY>
</HTML>


------------------------------------------------------------------
CONNECT www.myWebsite.net:443 HTTP/1.0
User-Agent: Mozilla/4.0 (...)
Proxy-Connection: Keep-Alive
Content-Length: 0
Host: www.myWebsite.net
Pragma: no-cache

------------------------------------------------------------------
CONNECT www.myWebsite.net:443 HTTP/1.0
User-Agent: Mozilla/4.0 (...)
Proxy-Connection: Keep-Alive
Content-Length: 0
Proxy-Authorization: Negotiate TlRMTV...DFSRVNMRU4=
Pragma: no-cache
Host: www.myWebsite.net

------------------------------------------------------------------
------------------------------------------------------------------
Now connect via https to Microsoft.com >> WORKS!!!
------------------------------------------------------------------
------------------------------------------------------------------
CONNECT www.microsoft.com:443 HTTP/1.0
User-Agent: Mozilla/4.0 (...)
Proxy-Connection: Keep-Alive
Content-Length: 0
Host: www.microsoft.com
Pragma: no-cache

HTTP/1.1 200 DecryptTunnel Established
Timestamp: 10:40:52:5474
FiddlerGateway: Direct

This is a HTTPS CONNECT Tunnel. Secure traffic flows through this
connection.

Secure Protocol: Tls
Cipher: Rc4 128bits
Hash Algorithm: Md5 128bits
Key Exchange: RsaKeyX 1024bits

== Client Certificate ==========
None.

== Server Certificate ==========
[Subject]
CN=www.microsoft.com, OU=MSCOM, O=Microsoft, L=Redmond, S=WA, C=US

[Issuer]
CN=Microsoft Secure Server Authority, DC=redmond, DC=corp,
DC=microsoft, DC=com
...

------------------------------------------------------------------
CONNECT www.microsoft.com:443 HTTP/1.0
User-Agent: Mozilla/4.0 (...)
Proxy-Connection: Keep-Alive
Content-Length: 0
Host: www.microsoft.com
Pragma: no-cache

HTTP/1.1 200 DecryptTunnel Established
Timestamp: 10:40:52:8425
FiddlerGateway: Direct

This is a HTTPS CONNECT Tunnel. Secure traffic flows through this
connection.

Secure Protocol: Tls
Cipher: Rc4 128bits
Hash Algorithm: Md5 128bits
Key Exchange: RsaKeyX 1024bits

== Client Certificate ==========
None.

== Server Certificate ==========
[Subject]
CN=www.microsoft.com, OU=MSCOM, O=Microsoft, L=Redmond, S=WA, C=US

[Issuer]
CN=Microsoft Secure Server Authority, DC=redmond, DC=corp,
DC=microsoft, DC=com
...

------------------------------------------------------------------
CONNECT www.microsoft.com:443 HTTP/1.0
User-Agent: Mozilla/4.0 (...)
Proxy-Connection: Keep-Alive
Content-Length: 0
Host: www.microsoft.com
Pragma: no-cache

HTTP/1.1 200 DecryptTunnel Established
Timestamp: 10:40:58:9101
FiddlerGateway: Direct

This is a HTTPS CONNECT Tunnel. Secure traffic flows through this
connection.

Secure Protocol: Tls
Cipher: Rc4 128bits
Hash Algorithm: Md5 128bits
Key Exchange: RsaKeyX 1024bits

== Client Certificate ==========
None.

== Server Certificate ==========
[Subject]
CN=www.microsoft.com, OU=MSCOM, O=Microsoft, L=Redmond, S=WA, C=US

[Issuer]
CN=Microsoft Secure Server Authority, DC=redmond, DC=corp,
DC=microsoft, DC=com
...

------------------------------------------------------------------
CONNECT www.microsoft.com:443 HTTP/1.0
User-Agent: Mozilla/4.0 (...)
Proxy-Connection: Keep-Alive
Content-Length: 0
Host: www.microsoft.com
Pragma: no-cache

HTTP/1.1 200 DecryptTunnel Established
Timestamp: 10:40:59:1271
FiddlerGateway: Direct

This is a HTTPS CONNECT Tunnel. Secure traffic flows through this
connection.

Secure Protocol: Tls
Cipher: Rc4 128bits
Hash Algorithm: Md5 128bits
Key Exchange: RsaKeyX 1024bits

== Client Certificate ==========
None.

== Server Certificate ==========
[Subject]
CN=www.microsoft.com, OU=MSCOM, O=Microsoft, L=Redmond, S=WA, C=US

[Issuer]
CN=Microsoft Secure Server Authority, DC=redmond, DC=corp,
DC=microsoft, DC=com
...

------------------------------------------------------------------
CONNECT www.microsoft.com:443 HTTP/1.0
User-Agent: Mozilla/4.0 (...)
Proxy-Connection: Keep-Alive
Content-Length: 0
Host: www.microsoft.com
Pragma: no-cache


HTTP/1.1 200 DecryptTunnel Established
Timestamp: 10:40:59:3401
FiddlerGateway: Direct

This is a HTTPS CONNECT Tunnel. Secure traffic flows through this
connection.

Secure Protocol: Tls
Cipher: Rc4 128bits
Hash Algorithm: Md5 128bits
Key Exchange: RsaKeyX 1024bits

== Client Certificate ==========
None.

== Server Certificate ==========
[Subject]
CN=www.microsoft.com, OU=MSCOM, O=Microsoft, L=Redmond, S=WA, C=US

[Issuer]
CN=Microsoft Secure Server Authority, DC=redmond, DC=corp,
DC=microsoft, DC=com
...

------------------------------------------------------------------
GET / HTTP/1.1
Accept: */*
UA-CPU: x86
Accept-Encoding: gzip, deflate
Cookie: ...
User-Agent: Mozilla/4.0 (...)
Host: www.microsoft.com
Connection: Keep-Alive
Accept-Language: en-us

HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: /en/us/default.aspx
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo
OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Date: Tue, 04 Aug 2009 14:40:58 GMT
Content-Length: 142

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="%2fen%2fus%2fdefault.aspx">here</a>.</h2>
</body></html>

------------------------------------------------------------------
GET /en/us/default.aspx HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-ms-application, application/vnd.ms-xpsdocument,
application/xaml+xml, application/x-ms-xbap, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, application/x-
shockwave-flash, */*
UA-CPU: x86
Accept-Encoding: gzip, deflate
Cookie: ...
User-Agent: Mozilla/4.0 (...)
Host: www.microsoft.com
Connection: Keep-Alive
Accept-Language: en-us


HTTP/1.1 200 OK
Cache-Control: public
Content-Type: text/html; charset=utf-8
Expires: Tue, 04 Aug 2009 14:50:59 GMT
Last-Modified: Mon, 03 Aug 2009 18:11:59 GMT
ETag: 633848947190000000
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo
OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Date: Tue, 04 Aug 2009 14:40:58 GMT
Content-Length: 77144

?<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html> ... </
html>
------------------------------------------------------------------

EricLaw

unread,
Aug 5, 2009, 1:26:17 PM8/5/09
to Fiddler
Fiddler's HTTPS interception feature simply does not get along with an
authenticating upstream proxy server.

Since your proxy server accepts BASIC authentication, you could do a
hack whereby you check to see if the HTTP Method is CONNECT and if so,
add a Proxy-Authorization header containing the base-64'd proxy
credentials to the outbound CONNECT request.

-Eric

On Aug 4, 8:25 am, Tony <afr...@gmail.com> wrote:
> I am using Fiddler v2.2.4.1 to capture traffic to a secure website.
> The company uses a proxy that requires authentication and Fiddler is
> setup to chain to the upstream proxy.  This is working fine for almost
> everything I do, except for the web app I must test :-(
>
> I am getting HTTP/1.1 407 Proxy Authentication Required for the TTE
> but everything works if I https to other sites, i.e.https://www.microsoft.com.
> Content-Location:http://www.myWebsite.net/default.htm?403;http://www.myWebsite.net:80/...

Tony

unread,
Aug 5, 2009, 4:52:48 PM8/5/09
to Fiddler
Eric,

Thanks for the tip. I'm a huge fan of Fiddler. I'm posting the code
here for the benefit of the community.

Add the following to OnBeforeRequest

if (oSession.HTTPMethodIs("CONNECT") && oSession.HostnameIs
("myWebsite.com"))
{
oSession.oRequest.headers.Add("Proxy-Authorization","BASIC
user:passsword");
}

where "username:password" must be Base64 encoded.

Tony
Reply all
Reply to author
Forward
0 new messages