{"id":812,"date":"2013-05-04T16:30:53","date_gmt":"2013-05-04T15:30:53","guid":{"rendered":"http:\/\/emtunc.org\/blog\/?p=812"},"modified":"2013-06-15T13:03:28","modified_gmt":"2013-06-15T12:03:28","slug":"tampering-with-mobile-traffic-using-fiddler","status":"publish","type":"post","link":"https:\/\/emtunc.org\/blog\/05\/2013\/tampering-with-mobile-traffic-using-fiddler\/","title":{"rendered":"Tampering with Mobile Traffic Using Fiddler"},"content":{"rendered":"

In part one<\/a> of these series I talked about how you can very easily capture mobile traffic using Fiddler<\/a>.<\/p>\n

In this second part, I will talk about how you can actually tamper with the traffic you send and<\/strong> receive to and from your mobile device.
\nPlease note that tampering with traffic is not just limited to mobile traffic!<\/p>\n

<\/p>\n

Whether you are a developer, penetration tester or just curious (I fit in to the latter category :)), being able to tamper with your requests and responses will give you a better insight in to what can be done with an application, how it will respond to specific input against what is expected, etc.<\/p>\n

Assuming you have followed the first part of this series<\/a>, tampering with the requests and responses is fairly simple.<\/p>\n

Breakpointing all requests and responses<\/span><\/p>\n

Go to the ‘Rules<\/em>‘ tab at the top and select ‘Automatic Breakpoints<\/em>‘. Now either select ‘Before Requests<\/em>‘ or ‘After Responses<\/em>‘.<\/p>\n

Before requests means you can edit the request before it is sent to the server. You can also edit the response back to the client if you wish. I will show this later down.<\/p>\n

After responses means you edit only what is sent back to the client.<\/p>\n

Breakpointing a certain request<\/span><\/p>\n

If you want to break point a certain request, for example POST requests sent to http:\/\/www.example.org\/login, simply type bpu http:\/\/www.examle.org\/login<\/em> in to the little console bar like below:<\/p>\n

\"Fiddler<\/a>
Fiddler Console Bar<\/figcaption><\/figure>\n

Alternatively, if the request you want to breakpoint is already in the Fiddler window, just select it, type bpu<\/em> then press CTRL+i and the URL will be autofilled for you.<\/p>\n

When a breakpoint is hit, you will see a window like the below.<\/p>\n

\"Hitting<\/a>
Hitting a breakpoint in Fiddler<\/figcaption><\/figure>\n

When you hit the breakpoint, you can tamper the request (the top pane).
\nWhen you are done, hit Break on Response<\/em> to tamper the request back to the client (the bottom pane) or click Run to Completion<\/em> to just tamper the request and not the response.<\/em><\/p>\n

There is a lot<\/strong> you can do with Fiddler and this is only touching the surface.
\nHope you found this short article useful.<\/p>\n","protected":false},"excerpt":{"rendered":"

In part one of these series I talked about how you can very easily capture mobile traffic using Fiddler. In this second part, I will talk about how you can actually tamper with the traffic you send and receive to and from your mobile device. Please note that tampering with traffic is not just limited […]<\/p>\n","protected":false},"author":32,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":""},"categories":[1],"tags":[101,108],"class_list":["post-812","post","type-post","status-publish","format-standard","hentry","category-tech","tag-fiddler","tag-tampering"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1trTO-d6","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts\/812","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/users\/32"}],"replies":[{"embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/comments?post=812"}],"version-history":[{"count":9,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts\/812\/revisions"}],"predecessor-version":[{"id":885,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts\/812\/revisions\/885"}],"wp:attachment":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/media?parent=812"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/categories?post=812"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/tags?post=812"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}