Customize Client Hello

[Tom]

Some servers react differently depending on the Client Hello. Is there some way to mimic the hello of applications like Chrome?
Chrome for example uses its own ssl library which for example provides GREASE. Which library does Fiddler use on a Linux system ?

I found: https://www.telerik.com/blogs/fiddler-and-modern-tls-versions

Which seems to go a bit in the direction of customizing the client-server connection. Is it possible to use selected ciphers and extensions?

For reference:
https://github.com/refraction-networking/utls
https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967

[Nick Iliev]

Hi Tom,

 

The classic Fiddler for Linux was experimental and is not currently supported-  the team introduced Fiddler Everywhere which aims to provide cross-OS support (Windows.Mac, Linux). However, GREASE is not yet supported by the classic Fiddler (feature request logged here) or by Fiddler Everywhere.

 

Regards,
Nick Iliev
Progress Telerik

[Tom]

Can you customize ciphers (or cipher order, extensions ...) to some extend with Fiddler Everywhere except GREASE? Does it use its own ssl library or the one provided by the OS?

[Simeon]

Hi Tom,

Both Fiddler and Fiddler Everywhere use the System.Net.Security.SslStream class from the .NET Framework in order to establish secure connections. Its API allows only for choosing which SSL\TLS protocols to use for the connection. Unfortunately, it does not allow to choose which specific ciphers and extensions to use for the Client/Server Hello messages.

Regards,
Simeon
Progress Telerik