Fiddler is a free program that will log HTTP and HTTPS requests on Windows. These instructions demonstrate how to use Fiddler to create an archive file (.SAZ) of these requests for troubleshooting purposes using the full version of Fiddler. As an alternative, there is a simplified version of Fiddler available that only supports capturing here: http://fiddlercap.com.
Warning: Distributing a SAZ file is potentially a massive security risk, especially if HTTPS decryption was enabled during the traffic capture, because any secrets that are sent over the wire (including even passwords or session cookies) will be included in the file. You can use Fiddler to AES-encrypt the SAZ file using a password via the save dialog, but you must still treat the exported SAZ file (and password) with extreme care!!
- If the web site that you need to profile uses HTTPS, please consider getting a dedicated VM set up for installing Fiddler. This will make trusting the Fiddler certificate (essentially a self-inflicted man-in-the-middle attack) less problematic. There are instructions on how to do that here if you’re going to be testing with old IE versions.
- Go to http://fiddler2.com and download Fiddler. You can use either the .NET 2 or .NET 4 version depending on which version of the framework you have installed. Install it accepting the defaults and run it.
- Do not perform this step if the site that you need to profile is HTTP-only. If the site that you need to profile uses HTTPS, open Tools… Fiddler Options… HTTPS tab. Enable “Decrypt HTTPS traffic”. When the SCARY TEXT AHEAD dialog comes up, click “Yes” to trust the Fiddler Root certificate, and then click “Yes” again to acknowledge that you want to allow man in the middle attacks on this computer (which is how Fiddler can decrypt your HTTPS traffic (good), and how malicious actors who also have a copy of the Fiddler certificate could too (bad)). More information is available here: http://docs.telerik.com/fiddler/configure-fiddler/tasks/DecryptHTTPS
- If you want to use a browser other than Internet Explorer to generate the SAZ file, you may need to follow additional instructions here: http://docs.telerik.com/fiddler/configure-fiddler/tasks/ConfigureBrowsers
- Minimize Fiddler, and now browse to the site you want to test. Tab back to Fiddler and you should see the HTTP and HTTPS calls that were made while the capture was running. For example, here is a visit to the www.google.com homepage. To see the session details, select the Inspectors tab, and click the “Raw” on both the top and bottom panels – this allows you to see the exact text that was requested from the server by the browser and the browser’s exact response.
In this screenshot, you can see the list of sessions that happened as a result of accessing www.google.com. When I clicked on a session at random, I was able to see the details on the right-hand pane when I selected Inspectors and then Raw on the top and bottom section. - To export the SAZ file, select the sessions that are interesting in the left-hand pane and click File… Save… Selected Sessions… in ArchiveZip… Select “Password Protected SAZ” in the “Save as type” field. “Save the SAZ file in a secure location. It’s best to exclude things like login pages or other forms with secrets if they’re not relevant to the issue you’re troubleshooting because exported SAZ file will contain any secrets that were transmitted (including HTTPS transmitted items if HTTPS Decryption is enabled). Choose a strong password. You will need to share this password with whomever you wish to open the file.
- Securely provide the SAZ file and password to whomever needs it. Again - this file contains EVERYTHING that was sent on the computer via HTTP (and potentially HTTPS) including potentially passwords, session cookies, and other secrets that can be read in clear text if you have the SAZ password. It is critically important to care for this file and the password in a secure manner!! (Can you tell that this is important?)
- When the other party has the SAZ file on their computer, they can open it by opening Fiddler and clicking File… Load Archive…
- If you enabled HTTPS traffic decryption, your computer is still at risk until you perform the following two steps:
- Disable HTTPS decryption by opening Tools… Fiddler Options… HTTPS tab, and unchecking Decrypt HTTPS traffic.
- Also, click the “Remove Interception Certificates” button to delete the Fiddler certificates.
See: http://stackoverflow.com/questions/16827901/how-do-you-remove-the-root-ca-certificate-that-fiddler-installs
