| Slajdy k přednášce o tom, jak jednoduše používat Fiddler k průzkumu HTTPS komunikací, bez ohledu na to, jestli to je prohlížeč, nebo GUI program, si můžete stáhnout zde.
Současně je zde zdrojový kód skriptu pro nastavení proxy (ať už to je Fiddler nebo něco jiného). Baťáček je zajímavé také tím, že si umí sám požádat o zvýšení UAC oprávnění (elevate - spustí se podruhé zvýšeně pomocí parametru -Verb runas):
fiddle.bat
@ECHO OFF
IF "%1" == "noElevate" GOTO NoElevate
powershell -NoLogo -ExecutionPolicy Bypass -Command "Start-Process %~d0%~p0%~n0.bat noElevate -Verb runas"
GOTO Exit
:NoElevate
powershell -NoLogo -ExecutionPolicy Bypass -File "%~d0%~p0%~n0.ps1"
:Exit
fiddle.ps1
[string] $fdl = (Read-Host 'Fiddler machine name (or [-] to reset proxy)').Trim()
if ($fdl -eq '') {
$fdl = 'localhost'
}
if (($fdl -ne '-') -and ($fdl -ne '[-]')) {
if ($fdl -notlike '*?:?*') {
$fdl = '{0}:8888' -f $fdl
}
Set-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyServer $fdl
Set-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyEnable 1
Set-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyServer $fdl
Set-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyEnable 1
Set-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyServer $fdl
Set-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyEnable 1
Set-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyServer $fdl
Set-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyEnable 1
# Note: for example, the "Bypass proxy for local addresses" would be specified as
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyOverride
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyOverride
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyOverride
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyOverride
netsh winhttp set proxy $fdl | Out-Null
$remoteFdl = $fdl.Split(':')[0]
if (($remoteFdl -ne 'localhost') -and ($remoteFdl -ne '127.0.0.1')) {
$remoteAdmin = (Read-Host 'Credentials to make Fiddler certificate trusted (or nothing to skip)').Trim()
if (($remoteAdmin -ne '') -and ($remoteAdmin -ne '-')) {
$remotePwd = (New-Object System.Management.Automation.PSCredential ('DummyLogin', (Read-Host 'Password' -AsSecureString))).GetNetworkCredential().Password
[System.Management.ConnectionOptions] $wmiRegOptions = New-Object System.Management.ConnectionOptions
$wmiRegOptions.Impersonation = [System.Management.ImpersonationLevel]::Impersonate
$wmiRegOptions.Username = $remoteAdmin
$wmiRegOptions.Password = $remotePwd
$wmiRegOptions.EnablePrivileges = $true
[System.Management.ManagementScope] $wmiRegScope = New-Object System.Management.ManagementScope (('\\{0}\root\default' -f $remoteFdl), $wmiRegOptions)
$wmiRegScope.Connect()
[System.Management.ManagementClass] $wmiReg = New-Object System.Management.ManagementClass ($wmiRegScope, 'stdRegProv', $null)
[System.Management.ManagementBaseObject] $wmiRes = $wmiReg.EnumKey(2147483650, 'Software\Microsoft\SystemCertificates\Root\Certificates')
foreach ($oneThumbprint in ([string[]] $wmiRes.sNames)) {
$wmiRes = $wmiReg.GetBinaryValue(2147483650, 'Software\Microsoft\SystemCertificates\Root\Certificates\{0}' -f $oneThumbprint, 'Blob')
[Security.Cryptography.X509Certificates.X509Certificate2] $oneCert = New-Object Security.Cryptography.X509Certificates.X509Certificate2 @(, ([byte[]] $wmiRes.uValue))
if ($oneCert.Subject -eq 'CN=DO_NOT_TRUST_FiddlerRoot, O=DO_NOT_TRUST, OU=Created by http://www.fiddler2.com') {
$rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store ('Root', 'LocalMachine')
$rootStore.Open('MaxAllowed')
$rootStore.Add($oneCert)
$rootStore.Close()
}
}
}
}
} else {
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyServer
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyEnable
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyServer
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyEnable
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyServer
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyEnable
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyServer
Remove-ItemProperty 'Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' ProxyEnable
netsh winhttp reset proxy | Out-Null
}
Write-Host ('')
Read-Host 'Press ENTER to exit'
|