Does Fiddler view/store/display credentials?

[Robert]

We are troubleshooting an issue using Fiddler and wanted to know if Fiddler grabs credentials as part of it's network traffic capture that could be used by others.  Obviously, if it's an unencrypted password being sent then that would work, but with encryption and session management, is it possible for someone to utilize credentials seen in the traffic capture to compromise security?

[Nick Iliev]

Hi Robert,

 

As far as I understood your question is are encrypted password "visible" in traffic decrypted by Fiddler (and possibly shared with 3rd party). If this is the question then the answer is yes as Fiddler is the "man-in-the-middle" via the trusted certificate. However, for any external party, the whole traffic will be encrypted from end to end. Use Fiddler only with trusted parties and keep in mind that HTTPS decrypted traffic by Fiddler is readable in a way that is not possible for external users (which are not signed with trust certificates and are not acting as a "man-in-the-middle" proxy). See this thread for more details about a similar question related to using Fiddler as a man in the middle.

 

Regards,
Nick Iliev
Progress Telerik