The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

5

Take a look at these instructions for how to make Fiddler decrypt TLS traffic. It tells you to install Fiddlers root certificate into the OS trust store. This implies that they are doing classic TLS interception - there is one TLS connection between the browser and Fiddler, and another between Fiddler and the server. The first one uses a certificate ...


4

If you are using fiddler to intercept the HTTPS connection with a self installed certificate then you are conducting an active, self induced, 'man in the middle' on your connection. This means fiddler is intercepting and decrypting and reencrypting the traffic between the phone and the web server, allowing you to 'see' into the packet.


2

If the software is indeed open source,your best bet is to download the source code,audit it and compile it yourself. Otherwise, there are forensic technics that can assess what the software is doing when running but they are more complex to employ correctly. In both case,you will need (much) more expertise than can be easily written down in a simple post ...


2

If you can see the TLS handshake but nothing more (that is, the CONNECT request is not followed by any other requests), the client (the malware in this case) is probably pinning the server certificate (or at least public key), and rejecting the certificate that Fiddler offers it because that's not the expected one. If this is the case, you still have a few ...


1

Without much knowledge of packet capture software like wireshark. It maybe better to look into something simpler such as glasswire to see if it even makes an outgoing connection, if not then you have nothing to worry about, else you can look into deeper analysis


1

Fiddler isn't the good tools for that purpose. Instead, i would use wireshark (Open Source network capture tool) which will report you every network packets that pass through your machine (including others application traffic, Windows Update traffic, etc...)


1

You won't see a process if the request is not from the local machine, I.E., if you are allowing other machines to proxy via Fiddler. Check the Tools | Telerik Fiddler Options menu, and on the Connections tab, see if "Allow remote computers to connect" option is checked. If it is, this is likely where these requests are coming from, and why you can't ...


Only top voted, non community-wiki answers of a minimum length are eligible