I couild highlight a row in the captured data and hit the context menu for Copy | Session and it would copy the data and present it in this type of format when pasted into notepad:

PUT https://xxx.xxx.xxx.xxx/service/core/v3/AssetPartitions/-1/DiscoveryJobs/29 HTTP/1.1

GET https://10.5.33.172/service/core/v3/AssetPartitions/1/DiscoveredSshKeys/23/10?page=0&limit=200 HTTP/1.1
Accept-Language: en-US; q=1.0, en; q=0.9
X-SignalR-Id: f83b9717-2553-438f-b76c-4c3e70159a39
Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjQyRjIzMDlCQzZGMkNFQzNBQzc1MTA3RUQyRTFCREE4NzEwQUI5MUIiLCJ0eXAiOiJKV1QiLCJ4NXQiOiJRdkl3bThieXpzT3NkUkItMHVHOXFIRUt1UnMifQ.eyJBY3R1YWxVc2VySWQiOiIxIiwiQXV0aFRva2VuSWQiOiI2OTdlZDkzOC05YTY1LTQyZDctODI2MS04MGRiYzhkYTE1OWQiLCJyc3RzOnN0czpjbGFpbXM6dXNlcjp1c2VySWQiOiIxIiwidXBuIjoiU3VwZXIiLCJhdXRobWV0aG9kIjoibG9jYWw6cHdkIiwibmFtZWlkIjoiU3VwZXIiLCJuYmYiOjE1ODc0OTI1MzMsImV4cCI6MTU4NzU3ODkzMywiaWF0IjoxNTg3NDkyNTMzLCJpc3MiOiJ1cm46dG9rZW5hdXRoZW50aWNhdGlvbnByb3ZpZGVyOlNBRkVHVUFSRF9BUFBMSUFOQ0UifQ.Leqmwi7cbogsB_XYv9DpJ2SCgCtkl7WsY8Y6pXjfHVSm1P9-82ayeNK_J9rmQUdqZrWjmCeK4DxiyifKAzpgCJm5y0XgUX02jJ5RiD_i8EWOT6ywyxgRRKLefm36jHsWVavLpidJMo4QyOEUGX1OHw0-Cgv2kJyESwkNYLgVQB34WEGMSe2Sh1kVkQrVl-WwcmlckL7yw5rPaofje5lEXrbGMHbNTfBAuei08DVf49DBjV7FGZWRMpvB3mIpWqAZylTXu2DNcfol2ZuVYG1PmTY7pENZGzO98gT7c08Q6wqbZF1846F47oZ2wZXrcYRHkNO8nJ6N7JUN8koGMQ2P6g
Host: 10.5.33.172


HTTP/1.1 200 OK
Cache-Control: no-store, must-revalidate, no-cache
Content-Length: 1872
Content-Type: application/json; charset=utf-8
Content-Language: en-US
Vary: Origin
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-XSS-Protection: 1; mode=block
Content-Security-Policy: object-src 'none'; img-src 'self' data:; font-src 'self'
Referrer-Policy: same-origin
X-Cluster-Role: primary
X-TokenLifetimeRemaining: 1433
Date: Tue, 21 Apr 2020 18:16:29 GMT

[{"DiscoveredDate":"2020-04-21T17:20:10.228Z","AccountName":"BobAdmin","AccountDomainName":null,"AccountId":10,"AssetName":"PAM-QA-WIN2019","AssetId":23,"AssetPartitionId":1,"AssetPartitionName":"Import","SshKeyProfileId":1,"SshKeyProfileName":"Import SSH Key Profile","SshKeyDiscoveryScheduleId":15,"SshKeyDiscoveryScheduleName":"Import SSH Key Discovery","PublicKey":"AAAAB3NzaC1yc2EAAAADAQABAAABAQCjJh0+dkm7SMIzhCVPaZTxu0pQA9uhScH26GSxDb5ddoYigi9dlq45/4zal230Nk4o3IQmbP7hLikKTCr2Y3GRUZJEJ8IdQe9zXtGnm+N2iczbmg9kGPcb6j3pMcfxrjZlcOFOXgRaz1tnJXdaSLuM4kI45+sJjtdJ9e/nDdX1HgWVyo0U3CO7q/k/srI1+KaetKW58iCIK6zZnoW8jUhmyXdxA/UkkOwUCdK7kQwOn6kBV7pRgErS1nWmd4RZ7UNi0iSpZdrg6yL7mngLfzS7ee4iZ2Hp3WUY8s1aYhPkDJcJl6uEbxy2NpwLvbUgCWcbJCUPRQUKAdheR7uJuTfF","Comment":"bross@prod@Q3LJ2RQ2","Fingerprint":"4D7280929A77CAD8C0EF03099AF90F4F","KeyType":"Rsa","Options":null,"KeyLength":2048,"AccountStatus":"Managed","IsIgnored":false,"IsManaged":true},{"DiscoveredDate":"2020-04-21T17:20:09.686Z","AccountName":"BobAdmin","AccountDomainName":null,"AccountId":10,"AssetName":"PAM-QA-WIN2019","AssetId":23,"AssetPartitionId":1,"AssetPartitionName":"Import","SshKeyProfileId":1,"SshKeyProfileName":"Import SSH Key Profile","SshKeyDiscoveryScheduleId":15,"SshKeyDiscoveryScheduleName":"Import SSH Key Discovery","PublicKey":"AAAAB3NzaC1yc2EAAAADAQABAAABAQDP1WLHVC8mq6ICGre8OUPi5FQMYxomTGlSgnVqIvIUHLNI8PPH0xpkOpfhlZASzu7WtHWX37LDvEcUqW0gYb0eYww56IeERHui5yuJ7ocJnXETO33W+n0pnYjZuyqxEjSa8P14O6smg5z6bxm+/StItb8GyL1kBdQdoVeVMfWUSUO/2qyvmK22QOS8df2Gl+MWcBvsoU6rrtTq5N9FlS05zFsQJGUt/MrV3qHhKUqviFEZ1sl5ziisRknWInCb+YTkq7a5HFSbSAjxHZDjwPJ92gTWs+W/n6GsSY9Xjnjx+rFfpD1bSD4JnjwJ2QUsbTLPutJ0CpLFdOUJbgzsQY1N","Comment":"Safeguard_Windows_SSH","Fingerprint":"850585DBE61DE4F2D638EC3DE66CCE83","KeyType":"Rsa","Options":null,"KeyLength":2048,"AccountStatus":"Managed","IsIgnored":false,"IsManaged":false}]

Now all I get is the URL...

Fiddler crashes sometimes with this message:

No se puede obtener acceso al objeto desechado.

Nombre del objeto: 'WinHttpAutoProxy'.

Type: System.ObjectDisposedException
Source: Fiddler
   en “.Ÿœ.ƒ•(String •, String& ‘‰, String& ”) en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\FiddlerCore\PlatformExtensions\Windows\FiddlerCore.PlatformExtensions.Windows.Shared\WinHttpAutoProxy.cs:línea 52
   en .‚•.œ(String –, IPEndPoint& žœ) en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\AutoProxy.cs:línea 142
   en Fiddler.Proxy.FindGatewayForOrigin(String sURIScheme, String sHostAndPort) en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\Proxy.cs:línea 805
   en Fiddler.ServerChatter.Œ() en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\ServerChatter.cs:línea 1056
   en Fiddler.ServerChatter.‹Œ(AsyncCallback ŒŒ) en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\ServerChatter.cs:línea 932
   en Fiddler.Session.‘() en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\Session.cs:línea 3638
   en Fiddler.Session.œ™(IAsyncResult Œ) en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\Session.cs:línea 3649
   en Fiddler.ServerChatter.ŽŒ() en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\ServerChatter.cs:línea 1518
   en Fiddler.ServerChatter.Œ() en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\ServerChatter.cs:línea 1472
   en Fiddler.ServerChatter.‹Œ(AsyncCallback ŒŒ) en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\ServerChatter.cs:línea 932
   en Fiddler.Session.‘() en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\Session.cs:línea 3638
   en Fiddler.Session.(Object ) en C:\JenkinsHome\jobs\FiddlerReleaseBuild\workspace\Fiddler2\Common\Core\Session.cs:línea 3426

Fiddler v5.0.20173.50948 (x86 x86) [.NET 4.0.30319.42000 on Microsoft Windows NT 6.1.7601 Service Pack 1] 

Fiddler's "Web Browsers" filter does not include msedge.exe as a web browser. This is the executable name of the new Chromium-based version of Edge that Microsoft is now working on.

This should be a one-line fix and very much appreciated by the many thousands of Fiddler+Edge users.

Describe the bug
After following the steps in the Capture All IIS Traffic on the Web Server Forum Post Fiddler goes into an endless loop.

To Reproduce
Steps to reproduce the behavior:

1. Disable the firewall on the IIS Web Server

2. Edit machine.config proxy settings to point to 127.0.0.1:8888

   <system.net>
       <defaultProxy>
           <proxy autoDetect="false" bypassonlocal="false" proxyaddress="http://127.0.0.1:8888" usesystemdefault="false" />
       </defaultProxy>
   </system.net>

3. Set the WinHTTP Proxy Settings to point to 127.0.0.1:8888
   netsh winhttp set proxy 127.0.0.1:8888

4. Change the IIS Site Bindings to an alternate Port. In this example, it is 8080
   

5. In Fiddler, execute !listen 80 in QuickExec
   

6. Add Custom Rule to Forward Requests Received to WinHTTP Port. In this case, 8080

   static function OnBeforeRequest(oSession: Session) {
       
       // ...Code removed for brevity...
       if(oSession.host == "[INSERT_HOST_NAME_HERE].com:80")
       {
           oSession.host = "[INSERT_HOST_NAME_HERE].com:8080"  /// This is the Fiddler Port
       }
       
       // ...Code removed for brevity...    
   }

Expected behavior
Fiddler should capture all traffic to and from the web server. This configuration should configure Fiddler as both the normal proxy and reverse proxy simultaneously.

Desktop (please complete the following information):

• OS: Windows Server 2012 R2
• Browser: Any
• Version: Any

I recently am having an issue with MS Teams while running fiddler.  MS Teams keeps giving disconnect errors. That's when I noticed that fiddler it proxying it's traffic even though I have filters set to "Show only the following Hosts", and teams.microsoft.com are not included in the hosts.  I also notice other items in my sessions list that are not in my list of hosts so what is going on?

I don't really want to post my list of hosts publicly.  If you need them, please let me know and maybe I can email them to someone.

The bug I'm reporting is sometimes the Session.HostnameIs() will return true even if the supplied hostname does not match Session.hostname and a port was passed by the client in the Host header.

HostnameIs function is documented as "This method compares the supplied hostname to the hostname of the request, returning true if a case-insensitive match is found."

What I think is happening is that rather than use Session.hostname for comparison Fiddler instead uses the Session.host (ie what was passed by the client in the Host header) and if a port is present maybe it incorrectly extracts out the hostname. Here is an example that shows the bug and why I think that.

In OnBeforeRequest add this code, which should only show an alert box if the hostname is test:

		if(oSession.HostnameIs("test")) {
			FiddlerObject.alert(oSession.hostname);
		}

Now in a browser try going to http://t:81/ and you will see it shows the alert box, in other words a match. Why? Well, I will guess based on my testing that your code in HostnameIs gets the index of the colon in the host t:81, which is 1, and then compares only that number of characters. So it's doing whatever is the javascript equivalent of !strnicmp("t", "test", 1).

This manifests itself through CONNECT as well, and probably more likely, since the standard ports are used in the Host header (IE might be an exception to this). For example, let's say you go to https://t/ in Firefox or Chrome and HTTPS decrypt is enabled. The Host passed by the client for the CONNECT is t:443 and so it's the same problem, !strnicmp("t", "test", 1).

This is not a theoretical issue for me, I was testing something earlier today where I had to treat a hostname that ended in .co different from the same hostname that ended in .com and it turned out the test I was doing applied to both of them because of this bug.

Removing interception certificates via Fiddler options "Remove Interception Certificates" only removes them from Personal and Trusted Root Certification Authorities of the Local Computer Store.

Certificates located in Current User Store - Trusted Root Certification Authorities  and Intermediate Certificates is not removed.

This certificate is not trusted after using "Remove Interception Certificates" and has status "This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store".

sigcheck -t[u]v doesn't show any warnings.

Tested this on both Windows 7 and 10.

Tried refreshing certmgr, restarting it, and rebooting machine with no success - certificates are still there.

This should

Hello,

I am getting the following error in fiddler and without Capture HTTPS CONNECTs it works, also in the Protocols I have enabled: <client>;ssl2;ssl3;tls1.0;tls1.1;tls1.2

fiddler.network.https> HTTPS handshake to <domain> (for #6) failed. System.Security.Authentication.AuthenticationException A call to SSPI failed, see inner exception. < The message received was unexpected or badly formatted

Win32 (SChannel) Native Error Code: 0x80090326

Ashen

[Edited by Telerik Staff to remove personal information and convert to bug report]

I'm trying many times this shortcut but it's doesn't work. When i'm try to copy Single Header with CTRL + C it's work but when i'm try to copy single header's value with CTRL + SHIFT + C shortcut it's didn't work.

This is a copy of Fiddler's new Feedback Portal not working properly submitted to the Fiddler groups forum:

I have submitted probably a dozen or two bugs to the Fiddler Feedback portal https://fiddler.ideas.aha.io/ideas . Fiddler recently changed the feedback portal software and attempted to import all existing bugs. The import was not done properly. Every bug I reported the old links do not redirect to the imported reports. If I search for a report by title only arbitrary comments of the reports are included. There are no screenshots or attachments. Also I cannot login to the portal with my yahoo account, it says "Oh, no! Something's not right, but we're sorting it out." I was able to salvage some of what I reported from screenshots of the old site but I don't remember all of what I reported. Please retry the import so what users reported remains open for discussion and fixing. One particular bug is really a nuisance and hasn't been fixed when I have one session open raw in inspector and I click on another session I have to wait a long time. I don't remember what bug I filed over it but I know I filed something.

(Since the original post I have been able to login with my yahoo account. It does not show any bugs for my e-mail and they're still broken missing content and comments as "Imported User")

In the Good Old Times™ "give feednback" just mean "give feedback".

Well, here is your feedback.

Why do i have to

• create an account I need like Aids
• confirm the account  I need like Aids
• set a password to an account I need like Aids
• log in with said account I need like Aids
• click the "report bug" button (finally)
• getting interrupted again by some page who tries to trick me in a fucking search
• find the "yes I really really want to report that bug" button
• and finally after all the above being able to GIVE SOME FUCKING FEEDBACK?

Why are you wasting my time? I did not make it buggy, it was you!

Hi,

I have a connectivity issue when I run Fiddler (Progress Telerik Fiddler Web Debugger). I work behind a corporate proxy server and the server IP is changed every few hours. The change in IP is normally okay, but when I am running Fiddler with the 'Automatically Authenticate' option enabled, then Fiddler shows an error every time the proxy is changed; it shows a yellow error message suggesting "The system proxy was changed. Click to reenable capturing".

Clicking on the error in Fiddler works fine and it reconnects, but I find this frustrating because if i don't realise there was an error in fiddler and don't click it immediately then it affects my connectivity and some activities on my pc start to fail without me realising.

My suggestion is that you should let Fiddler auto-reconnect when this type of proxy change happens and when the 'Automatically Authenticate' option is enabled. I know it can't try to reconnect forever because it will cause an endless cycle for other people who have other types of proxy disconnects, but in my case it would be very helpful to let fiddler at least try once to auto reconnect (for me 1 retry is usually fine and Fiddler is able to connect to the new proxy address, but perhaps you can let the number of retries be a menu option so that users can set the number of retries that they want Fiddler to do after there was a proxy change or proxy error).

Thanks so much for your work, I really like Fiddler!

I hope you can bug fix this or add it as a feature, it will be very helpful!

Regards,

Eugene

When HTTPS decryption is enabled in Fiddler, Fiddler parses the ClientHello and ServerHello HTTPS messages to determine the supported ciphers and other information, including TLS Extensions.

Unfortunately, Fiddler's HTTPSMessages parsers have a bug whereby if the extensions are larger than the available data on the stream/pipe, reading of the extensions is skipped and misleading text suggesting that no extensions were sent is shown in the Inspectors. For instance, the current version of Chrome Canary sends ~1308 bytes of TLS extensions in the ClientHello, but only 908 bytes are available at the time that the message is read. Fiddler claims that the ClientHello contained no extensions. 

Instead of performing a single .Read() call and ignoring the result if the size is less than expected, Fiddler should continue to read the stream until the promised number of bytes have been read.

[This issue is similar to https://crbug.com/1028602#c2, although the implementation is obviously unrelated).

When my machine restarts before Fiddler is closed gracefully, Fiddler opens back up with an error saying that my capture saz is corrupt and cannot be opened.  
This is a pain as I have to then manually rebuild any requests that I need.

Fiddler should have savepoints or some way to prevent it from losing all my LogResuest history whenever Fiddler is forcefully shut down

(Some blocking rules are not shown)

When I use the "filter now" function, it does not filter properly.

It goes like this:

Prior to this, I used the "Filters" feature, but there was always a link that was not blocked.(this url: https://watson.telemetry.microsoft.com/Telemetry.Request  )

With the "Filters" function turned on, I used the "Filter now" function several times to block this link, but the result was only blocked at that time, and then came out again.

Now I turn off the "Filters" function, and then use "Filter now" to block that link. As a result, the blocking rule is not displayed in the lower left corner. Other blocking rules can be displayed normally.

I'm using Fiddler [Oct-03-19] v5.0.20194.41348 on Windows 7 Enterprise. There's no way to disable the 'Get Started' panel on startup. 'Show on startup' is not checked but it still shows. Also it doesn't look very good. Also it downloads javascript and other stuff via http unencrypted from fiddler.com, and I'd like to stop that.

Once a program has been "Filter now"ed via the context menu, if that filter is later deleted from down bottom, that program can no longer be "Filter Now"ed again; nothing happens.

It's as if program filtering is only given one opportunity to be "Filter Now"ed. Once that's happened, even if they filter gets deleted, the program isn't given another opportunity to be Filter Now'ed.

I get the following exception saying to quit or continue the application, if I continue capture does not begin.

Here's the content of the error:

Hi sir,

     I am an android developer from China, I really like to use Fiddler.But today,when I try to download it, I find avery serious error that Taiwan and Hong Kong are in the 'Country' option. Everyone knows that Taiwan and Hong Kong are part of China,please  add '-China' behind them,thanks.

     Or just like Oracle ,the picture below is a screenshot of my from Oracle.

     I will follow this thing! :)