HTTPs requests from iOS and Android devices are not decoded in Fiddler
When working with Fiddler, problems often arise that are solved by restarting the sniffer, restarting the computer or device from which the traffic is being sniffed. But it also happens that a restart did not solve the problem, and even a complete reinstallation of fiddler. This article is not about something new and unknown, but rather a tutorial that will help you when you did everything right, but "nothing works".
First of all, it is worth checking (even if you have already checked) the settings of Fiddler and the device from which you want to sniff traffic.
Setting up Fiddler on Windows to sniff traffic from iOS and Android devices
-
Open Fiddler
-
Go to Tools -> Options
-
In the Connections tab, check the box Allow remote computers to connect
-
Reload Fiddler for the changes to take effect
-
In the HTTPS tab:
1) check the box for Capture HTTPS CONNECTs
2) check the box Decrypt HTTPS traffic
3) in the appeared window “Trust the Fiddler Root certificate” click Yes
4) in the Security Warning window, click Yes
5) in the Add certificate to the Machine Root List? Click Yes
6) in the appeared window “Do you want to allow this app to make changes to your device?” choose Yes
7) check the box Ignore server certificate errors (unsafe)
-
Leave all other tabs as default and click OK.
-
Activate Stream and Decode in the top toolbar
Setting up an iOS device to work with Fiddler
-
Open Settings
-
Tap Wi-Fi
-
Tap the i icon for the network that the device is connected to
-
Scroll down and go to Configure Proxy
-
Select Manual
-
Enter your IP address in the Server field
-
In the Port field, enter your Port, tap Save
-
Open a browser and enter http://ipv4.fiddler:{Port} in the address bar. For example, if the port is 8888, then the link will look like this http://ipv4.fiddler:8888 OR enter {IP}:{Port} in the address bar, for example, 192.168.162.202:8888
-
Tap on the link “FiddlerRoot certificate” and download the certificate
-
Go to Settings -> General -> Profile and install the downloaded certificate
-
Go to Settings -> General -> About -> Certificate Trust Settings and check the box for our certificate
Setting up an Android device to work with Fiddler
-
Open Settings
-
Tap Wi-Fi
-
Tap and hold the Wi-Fi network your device is connected to
-
Select Modify Network
-
Select “Show advanced options”
-
Tap Proxy and select Manual
-
Enter your IP address in the Server field
-
In the Port field, enter your Port, tap Save
-
Open a browser and enter http://ipv4.fiddler:{Port} in the address bar. For example, if the port is 8888, then the link will look like this http://ipv4.fiddler:8888 OR enter {IP}:{Port} in the address bar, for example, 192.168.162.202:8888
-
Tap on the link “FiddlerRoot certificate”, the certificate will be downloaded to the device
-
Installation should happen automatically, if the certificate is not installed, then swipe down and tap the Settings icon
-
Go Personal -> Security
-
Go to Credential Storage and tap “Install from storage”
-
Tap on the FiddlerRoot.cer file
-
(Optional) Enter the name of the certificate, for example, FiddlerRoot
-
You can check this configuration Trusted credentials -> User, the installed certificate should be displayed there
HTTPs requests remain encrypted
-
You need to download the certificate generation plugin “CertMaker for iOS and Android” here
-
Go to Fiddler in Tools -> Options -> HTTPS and in Certificates generated by select CertMarker
-
Restart Fiddler
-
Re-download the certificate on the device from http://ipv4.fiddler:{Port}, because it will be regenerated
-
Install the certificate on the device
After all the above manipulations, Fiddler will obediently decode the necessary HTTPs requests from the device.