Hi Eirc,
     Thank you for your wonderful Fiddler first of all.
     I want use Fiddler Script to save or export the packets I'm interested in automaticly.But I don't know how to do.
     
    For example,I need to save all the packet to the destination hostname 'www.xxx.com'.
    I think I can add the auto save code like this:

    if (oSession.host.indexOf("www.xxx.com") > -1) {
     //save or export the packet to my own file
   }

   Does Fiddler Script supports write data to local file,And how to do it ?

   Maybe there's some other way to export or save the specific packets automaticly ,would you please tell us how to ?
   
   Thanks.

Stephen
   

Currently, I can view all traffic (both HTTP and HTTPS) from my Win8 Phone when browsing the web. However, when I launch a game, I am unable to see any of the calls made. Even HTTP Connect calls are unable to be seen. I'm currently checking this on an actual Win8 Phone and not an emulator. To see the calls appropriately, will I need to be using the emulator or will this make a difference?

Thanks,
Mason

Hi,

On visiting https sites like https://google.com, etc. from non-administrator windows account shows following error in chrome-

Note: There are no issues with Administrator account. Also latest fidder dll is used.

Kindly suggest.

=====ERROR=========================

Your connection is not private

NET::ERR_CERT_INVALID

Subject: www.google.co.in
Issuer: DO_NOT_TRUST_FiddlerRoot
Expires on: Jan 9, 2025
Current date: Jan 9, 2015
PEM encoded chain: -----BEGIN CERTIFICATE-----
MIIEIDCCAwigAwIBAgIQTlVbjpOQwE2xzdCLAw6zwjANBgkqhkiG9w0BAQsFADBq
MSswKQYDVQQLDCJDcmVhdGVkIGJ5IGh0dHA6Ly93d3cuZmlkZGxlcjIuY29tMRgw
FgYDVQQKDA9ET19OT1RfVFJVU1RfQkMxITAfBgNVBAMMGERPX05PVF9UUlVTVF9G
aWRkbGVyUm9vdDAeFw0xNTAxMDIwMDAwMDBaFw0yNTAxMDkwMDAwMDBaMGIxKzAp
BgNVBAsMIkNyZWF0ZWQgYnkgaHR0cDovL3d3dy5maWRkbGVyMi5jb20xGDAWBgNV
BAoMD0RPX05PVF9UUlVTVF9CQzEZMBcGA1UEAwwQd3d3Lmdvb2dsZS5jby5pbjCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJcH4QBeyYzwqGnzXAJi/XGd
og+X3IUltUelLtp/4Gu4iJPY4lPiH7nZhOc4sflPvwgR9fjkW8VC66MaC7LIHxYE
QzY/F0vhQwtuyHuuytb+fJ83A016qB0dxIsKv23vRLJJWZNY2T070XFTPD0P90Wk
80OUTbNxSmwVjSO+v5Fj2punwacfyiSO/SwXdYK2Si4qPYfMrk4+XhGYWibISHuL
MkBb2txztAxrNiLD4srR0E4YBCYWVLzKzbxTcj/e+HXe+wWkVYxQMYawZoUTwZqG
F442jRcmkCwnjA+O6vJLnmhbfA57cafFxLE2WRCsgrjMl2rwlL+EC/AAkTYyymMC
AwEAAaOByTCBxjCBowYDVR0jBIGbMIGYgBTwWRI8PkxLwZJVD8ILIP3dE1jB7KFu
pGwwajErMCkGA1UECwwiQ3JlYXRlZCBieSBodHRwOi8vd3d3LmZpZGRsZXIyLmNv
bTEYMBYGA1UECgwPRE9fTk9UX1RSVVNUX0JDMSEwHwYDVQQDDBhET19OT1RfVFJV
U1RfRmlkZGxlclJvb3SCEACChZyw50T3L/zLgc+6CyswCQYDVR0TBAIwADATBgNV
HSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAQEAUTjBICxinfvOZUhO
zuLt1XBrJT1yrPOPVjEUExzeEiGWCe+uUTooavXlWdwXpL3g5PzBasLGNFxSTmpY
c1fOQuWWvqNcAwpgbZxmMVstseQ+q89BS3eyvNBB6mM7K91LseGHYBE7ji3FpRJs
Ggc2hDkoGBdWIgq3fKtd7kIxB7g7hMBt7ec2eCcDkU1ACONO4AUz3PifomKQ8yv0
Dh0pI2WVwCRhOxzX3HvXVBrrd6kam8PDudHhCTKPLY4DUaa8eaWC4DfVKYAp+uEk
pQgvqwAgw3drnGr0SB9AiTFXuPeEVtj9XUHZg/5VoC821npnh1NeFWyVlvlwRNTp
odIZhw==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDozCCAougAwIBAgIQALGostjdEpCpSiqILm1ymzANBgkqhkiG9w0BAQsFADBq
MSswKQYDVQQLDCJDcmVhdGVkIGJ5IGh0dHA6Ly93d3cuZmlkZGxlcjIuY29tMRgw
FgYDVQQKDA9ET19OT1RfVFJVU1RfQkMxITAfBgNVBAMMGERPX05PVF9UUlVTVF9G
aWRkbGVyUm9vdDAeFw0xNTAxMDIwMDAwMDBaFw0yNTAxMDkxNjA2MjdaMGoxKzAp
BgNVBAsMIkNyZWF0ZWQgYnkgaHR0cDovL3d3dy5maWRkbGVyMi5jb20xGDAWBgNV
BAoMD0RPX05PVF9UUlVTVF9CQzEhMB8GA1UEAwwYRE9fTk9UX1RSVVNUX0ZpZGRs
ZXJSb290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnPFzPLUapT7u
FJunqww41DAq3IrBAvn+rgwn/CtjloMANfBAYdslEQKyZXrYMUlbUoxD3ibewVv2
S+Y5fIUr/scFYi0lYdNNCfN68kxd0OAyEMpnU1l9NFj1l8+mz0GYHk+aT5roLFjj
slyV0gHQSjBogkLCyWrsU1yZgmKK0jph8GMHjeaqugiSjluwp7zMfMIhqlxLMAH8
kmhET1+wC3z8stAFVbzoEudq/gRsChHivc2+1FptWrVhTpDMYvxgKiCCOkiiphN3
+X6g4W4fDFVaLa9RGgVYdQIlBDxsdylAXv4EvKZ6vt+VZ8j88bxPZ8MOUdSrA8VH
1uEWK1e1lwIDAQABo0UwQzASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQE
AwICBDAdBgNVHQ4EFgQUsP3igXensy7iYLaTmhwc+vr4feswDQYJKoZIhvcNAQEL
BQADggEBAJdOMo0tPo8zluUliCJMbCn1UDkj9av4yir5vGHa9ettvsFF6E6JmHys
eM2d3DhPjT4hqhrx6KpJqFHAhW/EoHqurVbfvQhzVt2wYWx+Ivr83AXnpuHkbCrp
UnVSt3MlsY5/DrOWDQd+L3wGB3N5Wem8JOEhXZ7D7LkFEwEXvk3OPocVZ5RGrs9h
ghk2js5ewXAdWtudPnd2Gy8gjh5NIWgGZqaaNJkXHYSOZ2rlRhmzP2rYvX9FnzN3
t6jX/H4gucNVl6whQ17hcnHDeRQm1zNJAnYbh3bUn7TycqY+Ti9eotzgrQGZ8IbL
JcGMZRh+PlUuGD9oXf1Y0PSKzTQD93E=
-----END CERTIFICATE----

Hello,

I'd like to monitor traffic generated by an android app. The app is only sending part of the traffic through the default android proxy (which is set up on the wireless connection as documented on http://docs.telerik.com/fiddler/configure-fiddler/tasks/ConfigureForAndroid). However, I also want to monitor the part that is not going through the default android proxy.
How can this be achieved? Maybe by using iptables?

Hi,

Error --> ERR_TUNNEL_CONNECTION_FAILED

gets displayed on some https sites.

e.g. try the following url-

https://www.irctc.co.in/
https://www.virtuallythere.com/new/

Kindly suggest.

When using fiddlercore as web proxy in a WPF application and accessing web pages through a web browser control,  there are multiple socket exceptions thrown. When fiddler is turned off, we do not see these exceptions.

Fiddler start code snippet:
 const FiddlerCoreStartupFlags Flags = FiddlerCoreStartupFlags.Default;

            if (!FiddlerApplication.IsStarted())
            {
                FiddlerApplication.Startup(PortNumber, Flags);
            }

Fiddler shutdown snippet:
if (!FiddlerApplication.IsStarted())
            {
                return;
            }


            FiddlerApplication.BeforeRequest -= this.OnBeforeRequest;
            FiddlerApplication.ResponseHeadersAvailable -= this.OnResponseHeadersAvailable;

            FiddlerApplication.Shutdown();
            Thread.Sleep(TimeoutMilliseconds);

Below was the exception analysis using Windbg on a dump created:

Exception object: 0388db20
Exception type:   System.Net.Sockets.SocketException
Message:          An existing connection was forcibly closed by the remote host
InnerException:   <none>
StackTrace (generated):
    SP       IP       Function
    125EEA10 72C5D2F8 System_ni!System.Net.Sockets.Socket.Send(Byte[], Int32, Int32, System.Net.Sockets.SocketFlags)+0x6375e8
    125EEA30 0CEB335D UNKNOWN!Fiddler.BasePipe.Send(Byte[], Int32, Int32)+0x85
    125EEA50 0CEB51EA UNKNOWN!Fiddler.ServerChatter.LeakResponseBytes()+0xfa

StackTraceString: <none>
HResult: 80004005
*************
Exception object: 038ba308
Exception type:   System.Net.Sockets.SocketException
Message:          An existing connection was forcibly closed by the remote host
InnerException:   <none>
StackTrace (generated):
    SP       IP       Function
    0A7FF090 72C5D2F8 System_ni!System.Net.Sockets.Socket.Send(Byte[], Int32, Int32, System.Net.Sockets.SocketFlags)+0x6375e8
    0A7FF0B0 0CEB335D UNKNOWN!Fiddler.BasePipe.Send(Byte[], Int32, Int32)+0x85
    0A7FF0D0 0CEB51EA UNKNOWN!Fiddler.ServerChatter.LeakResponseBytes()+0xfa

StackTraceString: <none>
HResult: 80004005
*************
Exception object: 0390bf54
Exception type:   System.Net.Sockets.SocketException
Message:          An existing connection was forcibly closed by the remote host
InnerException:   <none>
StackTrace (generated):
    SP       IP       Function
    0674F2E4 72C5D2F8 System_ni!System.Net.Sockets.Socket.Send(Byte[], Int32, Int32, System.Net.Sockets.SocketFlags)+0x6375e8

StackTraceString: <none>
HResult: 80004005
*************
0:008>
Exception object: 03876124
Exception type:   System.Net.Sockets.SocketException
Message:          An existing connection was forcibly closed by the remote host
InnerException:   <none>
StackTrace (generated):
    SP       IP       Function
    0660F350 72C5D2F8 System_ni!System.Net.Sockets.Socket.Send(Byte[], Int32, Int32, System.Net.Sockets.SocketFlags)+0x6375e8
    0660F370 0CEB335D UNKNOWN!Fiddler.BasePipe.Send(Byte[], Int32, Int32)+0x85
    0660F390 0CEB51EA UNKNOWN!Fiddler.ServerChatter.LeakResponseBytes()+0xfa

StackTraceString: <none>
HResult: 80004005
*************
Exception object: 0388db20
Exception type:   System.Net.Sockets.SocketException
Message:          An existing connection was forcibly closed by the remote host
InnerException:   <none>
StackTrace (generated):
    SP       IP       Function
    125EEA10 72C5D2F8 System_ni!System.Net.Sockets.Socket.Send(Byte[], Int32, Int32, System.Net.Sockets.SocketFlags)+0x6375e8
    125EEA30 0CEB335D UNKNOWN!Fiddler.BasePipe.Send(Byte[], Int32, Int32)+0x85
    125EEA50 0CEB51EA UNKNOWN!Fiddler.ServerChatter.LeakResponseBytes()+0xfa

StackTraceString: <none>
HResult: 80004005
*************
Exception object: 038ba308
Exception type:   System.Net.Sockets.SocketException
Message:          An existing connection was forcibly closed by the remote host
InnerException:   <none>
StackTrace (generated):
    SP       IP       Function
    0A7FF090 72C5D2F8 System_ni!System.Net.Sockets.Socket.Send(Byte[], Int32, Int32, System.Net.Sockets.SocketFlags)+0x6375e8
    0A7FF0B0 0CEB335D UNKNOWN!Fiddler.BasePipe.Send(Byte[], Int32, Int32)+0x85
    0A7FF0D0 0CEB51EA UNKNOWN!Fiddler.ServerChatter.LeakResponseBytes()+0xfa

StackTraceString: <none>
HResult: 80004005
*************
Exception object: 0390bf54
Exception type:   System.Net.Sockets.SocketException
Message:          An existing connection was forcibly closed by the remote host
InnerException:   <none>
StackTrace (generated):
    SP       IP       Function
    0674F2E4 72C5D2F8 System_ni!System.Net.Sockets.Socket.Send(Byte[], Int32, Int32, System.Net.Sockets.SocketFlags)+0x6375e8

StackTraceString: <none>
HResult: 80004005

From http://www.enhanceie.com/Fiddler/help/httpsdecryption.asp, it says, 
if you've configured Fiddler to proxy traffic from a second computer or device...
but that URL (http://www.fiddler2.com/fiddler/help/hookup.asp#Q-NonWindows) is invalid, not actually linking to any specific article. 

Can we have the new url or a quick share of the steps please? 

Thanks

Rule Config

regex:(?insx)\/0Pl5sssO4/.+\.js$ #Versafe.js
C:\Users\chernyakov\Desktop\versafe\static.js

I would expect Autoresponder to respond with file contents. Instead, it rewrites my request 



GET http://xx.xx.43.176C:\Users\chernyakov\Desktop\script\static.js/ HTTP/1.1
Host: Xx.xx.43.176C:\Users\chernyakov\Desktop\script\static.js
Proxy-Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: */*

So I want to modify a standard Http 200 response from a server, which contains headers and an image in the responsebody. I want to selectively replace that image (ideally from  a stored image file; but the actual image will change over time and/or I want to select different images based on logic). I want to retain the original headers from the server response, and replace the responsebody image. I would use the OnBeforeResponse event to trap the response. The images are standard files (image file only, no http headers).

I see I can load an entire response from a file with FildderScript, but I can't see how to load just the responsebody from a file (binary image jpg/or png or gif). I thought possibly I could populate an array from the image file, and then use ResponseBody:System.Byte[] call to attach the image (and fix up the headers associated with the size/content type etc).

I have searched far and wide but haven't found any related example FiddlerScript for this operation. Could you post a snippet along these lines?

Yes I have tried resetting IE settings
Yes I have disabled and re-enabled IE
Yes I have tried the following steps:
1: Use Help > Troubleshoot Filters to make sure the traffic isn't getting hidden unexpectedly. --Nothing hidden
2: Look in the Log tab to see if there's a note about Chrome Group Policy hardcoding the proxy. --Recently set Chrome Policy to try and fix the issue. Not problematic
3: Update your question to mention whether other browsers' traffic is captured. --Nothing is captured except for Echo Service
4: Visit http://localhost.fiddler:8888/ in Chrome; What if anything do you see? --Echo Service
5: Visit http://127.0.0.1:8888/ in Chrome; What if anything do you see? --Echo Service
I have also tried to manually modify the registry settings. The result was Fiddler overriding them. I have tried process monitor, nothing is being captured at all.
After setting the Chrome Policy, it works, for Chrome anyways. I have disabled EVERY Chrome expansion. Nothing. I have also deleted Registry Keys, nothing.
I have crashed Windows trying to fix this, believe me I went in-depth. I have uninstalled the following as well to try:
1: Evolve VPN
2: Teamviewer VPN
3: Wireshark
4: WinPCap
5: Fiddler (Reinstalled)
6: CommView
With the exception of Fiddler, I have reinstalled nothing above. I do have Hamachi VPN installed, but I know it works for that. Note I am having the same exact issue on another laptop, meaning it is not entirely unique. The registry override ONLY occurs when refreshing Fiddler after registry change. I am ready to post any files I need.