Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've used the excellent Fiddler web debugging software before and have recently come across the Fiddler Core headless .NET library which gives you all the abilities of Fiddler in library form. It's able to sniff and modify HTTP and HTTPS requests and responses. So what's stopping someone from writing malware with this library e.g. for a MitM attack? Was it a good idea to release such a library like this?

share|improve this question
add comment

1 Answer

I think you may misunderstand the difference between malware and MitM attack tools. The former runs on the victim, the latter runs on the attacker.

If (through other means) you were able to get the victim's HTTP requests routed to you instead of their intended destination, sure. But there are other better tools that both perform the full process, not just the modifying you said was capable. So what's stopping people? Better alternatives.

The morality of the issue is a separate question, part of a an existing heated debate. My opinion? Even the tools that automate the full process are ethical in my opinion. They can/are used for testing and educational purposes. Furthermore, a lack of them will not deter determined attackers from creating their own. Believe me, it's a constant game of catchup and libraries like this aren't fueling the threat. Please though, that debate can occur elsewhere.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.