Fiddler web debugging proxy : install Fiddler on windows 7

about fiddler

http://fiddler2.com/

In short , you can debug HTTP/S sessions with fiddler

before installing fiddler , install .net framework which is required to use fiddler.

I installed dotNetFx40_Full_setup.exe. ( .net framework 4 )

install fiddler (fiddler4setup.exe )

run fiddler ( just click fiddler icon )

enable HTTPS decryption

GUI -> Tools -> Fiddler Options -> HTTPS

enable “Decrypt HTTPS traffic”

trace a specific web browser’s HTTP/S session

click “Any process” and then drop “+” icon to the IE GUI

trace IE’s HTTP/S sessions.

ESX 5 : how to use API over http instead of https

By default , SDK port is tcp 443 ( https://vcenter IP/sdk )
Here’s an explanation of how to enable both http and https access.
When evaluating SDK , it is useful to use http instead of https to debug.

1.
access to the vCenter server

2.

go to <Drive name>:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter” directory

3.
edit proxy.xml file.

from

<e id="9">      <_type>vim.ProxyService.LocalServiceSpec</_type>      <accessMode>httpsWithRedirect</accessMode>      <port>8085</port>      <serverNamespace>/sdk</serverNamespace>    </e>

to

<e id="9">      <_type>vim.ProxyService.LocalServiceSpec</_type>      <accessMode>httpAndHttps</accessMode>      <port>8085</port>      <serverNamespace>/sdk</serverNamespace>    </e>

4.
restart vCenter service

5. access to http://vCenter IP/sdk

over http

root@ubuntu1204-vm1:~# python Python 2.7.3 (default, Aug  1 2012, 05:14:39) [GCC 4.6.3] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> from pysphere import VIServer >>> server = VIServer() >>> server.connect("http://1.1.1.10/sdk","username",".password.") >>> server.get_server_type() 'VMware vCenter Server' >>> server.get_api_version() '5.1' >>> server.disconnect

over https

>>> server.connect("http://1.1.1.10/sdk","username",".password.") >>> server.get_server_type() 'VMware vCenter Server' >>> server.disconnect

Zen loadbalancer : how to encode/decode HTTPS with Zen LB

Here’s an explanation of how to configure encode/decode HTTPS traffic.

network topology

<- https ->       <- http -> Client ----------- Zen LB -------------- Server

- create a FARM for HTTPS loadbalancing ( FARM is similar to F5 LTM’s Virtual Servers )

Manage -> Farms -> Add new FARM




specify VIP , port number for HTTPS loadbalancing



- configure farm01-https



add a service ( service is similar to F5 LTM’s node/pool )
I’ll use “zencert.pem” as SSL cert/keys , which is self certification provided by Zen LB by deault.

- configure service “service01-farm01-https”

specify real servers IP and port number

- access to the HTTPS’s VIP (192.168.10.131 )from the client

nnn , the service is not available … why ?

When returning this message to the client ,it means that there are no services to load balance.

The following is Zen LB’s log when accessing to ZenLB’s VIP over HTTPS

zenlb-01 pound: (b72d8b70) e503 no service "GET / HTTP/1.1" from x.x.x.x

after disabling/enabling Farm “farm01-https” , I was able to access to VIP

disable the FARM

enable the FARM


I’ve created two FARMS , one is for HTTP load balancing , the other is for HTTPS.
HTTP LB processes PID 25840 , HTTPS processes PID 26529.

So you would trace how many CPU/Memory resources FARMS ( virtual servers ) consume from PID.


[ small tips ]

configuration files are stored under /usr/local/zenloadbalancer/config directory.

# pwd /usr/local/zenloadbalancer/config # ls farm01-https_Err414.html                           farm01_pen.cfg farm01-https_Err500.html                           fwmarks.conf farm01-https_Err501.html                           global.conf farm01-https_Err503.html                           if_eth0:0_conf farm01-https_pound.cfg                             if_eth0_conf farm01-https_service01-farm01-https_guardian.conf  if_eth1_conf farm01-https_status.cfg                            zencert.pem farm01_guardian.conf

Linux Mint 13 : can’t connect to only secure sites ( https )

mint-13 ~ # uname -a Linux mint-13 3.2.0-31-generic #50-Ubuntu SMP Fri Sep 7 16:16:45 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux mint-13 ~ # tail -1 /etc/lsb-release DISTRIB_DESCRIPTION="Linux Mint 13 Maya"

When I access to secure sites (https) , the load time of secure sites is very slow , I’ve faced timed out.
the load time of non secure sites are Okay , I can access to http site without stress.

why ??

Here’s a capture data when accessing to a secure site.
scaling factor is ..-1 ??? and window size is small..

mint-13 ~ # tshark -i eth0 port 443 -V | grep -i window tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled Running as user "root" and group "root". This could be dangerous. Capturing on eth0        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 942    [Calculated window size: 942]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 306    [Calculated window size: 306]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 331    [Calculated window size: 331]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set

window scaling is enabled by default

mint-13 ~ # cat /proc/sys/net/ipv4/tcp_window_scaling 1

disable window scale to try.

mint-13 ~ # echo 0 > /proc/sys/net/ipv4/tcp_window_scaling mint-13 ~ # cat /proc/sys/net/ipv4/tcp_window_scaling 0

access to the secure site again.
I could access to the secure site without stress.

Here’s capture data.
scaling factor is still -1 , however window size seems to become normal.

mint-13 ~ # tshark -i eth0 port 443 -V | grep -i window tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled Running as user "root" and group "root". This could be dangerous. Capturing on eth0        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 41850    [Calculated window size: 41850]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 41850    [Calculated window size: 41850]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 62851    [Calculated window size: 62851]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 41850    [Calculated window size: 41850]

wired behavior.

tshark version

mint-13 ~ # tshark -v | head -1 tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled TShark 1.6.7

turn off window scaling permanently

mint-13 ~ # tail -1 /etc/sysctl.conf net.ipv4.tcp_window_scaling = 0

the value of scaling factor "-1" seems to be tshark’s issue..

when enabling window scale.

mint-13 ~ # tshark -i eth0 port 443 | grep -i syn tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled Running as user "root" and group "root". This could be dangerous. Capturing on eth0  4.818885 192.168.11.100 -> 74.125.235.111 TCP 74 49827 > https [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=552473 TSecr=0 WS=128  4.823766 74.125.235.111 -> 192.168.11.100 TCP 74 https > 49827 [SYN, ACK] Seq=0 Ack=1 Win=14180 Len=0 MSS=1430 SACK_PERM=1 TSval=21743779 TSecr=552473 WS=64

when disabling window scale. there’s no scaling option in the TCP header.

mint-13 ~ # tshark -i eth0 port 443 | grep -i syn tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled Running as user "root" and group "root". This could be dangerous. Capturing on eth0  1.545670 192.168.11.100 -> 74.125.235.113 TCP 70 59065 > https [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=543894 TSecr=0  1.555951 74.125.235.113 -> 192.168.11.100 TCP 70 https > 59065 [SYN, ACK] Seq=0 Ack=1 Win=14180 Len=0 MSS=1430 SACK_PERM=1 TSval=21139320 TSecr=543894

decrypt SSL traffic with ssldump

decrypt SSL traffic with ssldump

[ installation ]

Ubuntu 11.04

root@hat1:~# apt-get install ssldump -y root@hat1:~# ssldump -v ssldump 0.9b3 Copyright (C) 1998-2001 RTFM, Inc. All rights reserved. Compiled with OpenSSL: decryption enabled

Fedora 15

[root@f15 ~]# yum list | grep ssldump [root@f15 ~]# ssldump -v ssldump 0.9b3 Copyright (C) 1998-2001 RTFM, Inc. All rights reserved. Compiled with OpenSSL: decryption enabled

[ decrypt SSL traffic ]

- At first , prepare Apache with SSL on Fedora 15

install httpd

[root@f15 ~]# yum install -y httpd mod_ssl

Sample SSL certification and configuration file for Apache are included in mod_ssl.

- SSL configuration file for Apache (/etc/httpd/conf.d/ssl.conf)

Private Key

SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

Certification file

SSLCertificateFile /etc/pki/tls/certs/localhost.crt

private key

[root@f15 conf.d]# openssl rsa -text -in /etc/pki/tls/private/localhost.key Private-Key: (1024 bit) modulus:    00:ea:cf:7c:fa:18:31:97:40:17:b8:85:5c:86:ec:    75:be:93:9c:cb:ce:7c:26:c7:29:30:41:f7:93:21:    8c:6c:4b:12:34:f5:78:40:94:ab:d9:70:75:a1:ec:    14:70:6e:8b:ce:fe:c0:35:85:66:24:bb:2c:b1:f2:

certification file

[root@f15 conf.d]# openssl x509 -text -in /etc/pki/tls/certs/localhost.crt Certificate:    Data:        Version: 3 (0x2)        Serial Number: 30063 (0x756f)        Signature Algorithm: sha1WithRSAEncryption        Issuer: C=--, ST=SomeState, L=SomeCity, O=SomeOrganization, OU=SomeOrganizationalUnit, CN=f15.localdomain/emailAddress=root@f15.localdomain        Validity            Not Before: Sep 21 14:30:35 2011 GMT            Not After : Sep 20 14:30:35 2012 GMT        Subject: C=--, ST=SomeState, L=SomeCity, O=SomeOrganization, OU=SomeOrganizationalUnit, CN=f15.localdomain/emailAddress=root@f15.localdomain        Subject Public Key Info:            Public Key Algorithm: rsaEncryption                Public-Key: (1024 bit)

- start Apache

[root@f15 conf.d]# apachectl start

confirm SSL is enabled

[root@f15 conf.d]# wget https://127.0.0.1 --no-check-certificate --2011-09-21 23:52:34--  https://127.0.0.1/ Connecting to 127.0.0.1:443... connected. WARNING: cannot verify 127.0.0.1’s certificate, issued by “/C=--/ST=SomeState/L=SomeCity/O=SomeOrganization/OU=SomeOrganizationalUnit/CN=f15.localdomain/emailAddress=root@f15.localdomain”:  Unable to locally verify the issuer’s authority.    WARNING: certificate common name “f15.localdomain” doesn't match requested host name “127.0.0.1”. HTTP request sent, awaiting response... 200 OK Length: 526 [text/html] Saving to: “index.html” 100%[======================================>] 526         --.-K/s   in 0s       2011-09-21 23:52:34 (4.45 MB/s) - “index.html” saved [526/526]

[ decrypt SSL traffic with ssldump ]

Client ( Utuntu , Firefox ) --------- Apache ( Fedora )

ssldump can decrypt SSL traffic under the following conditions

# man ssldump       ssldump can decrypt traffic between two hosts if the following two con‐       ditions are met:              1. ssldump has the keys.              2. Static RSA was used.

- configure Firefox to use static RSA.

Firefox -> about:config -> search “ssl” -> enable only “security.ssl3.rsa_rc4_128_sha”


capture SSL traffic on both client (Ubuntu11.04) and server ( Fedora 15 )

I could decrypt SSL traffic on Ubuntu machine , however I can’t decrypt on Fedora 15...

on Ubuntu , I could decrypt SSL :)

root@hat1:~# ssldump -i br0 -Ad -k localhost.key port 443 New TCP connection #2: hat1.local(48362) <-> f15.local(443) 2 1  0.0010 (0.0010)  C>SV3.1(53)  Handshake      ClientHello        Version 3.1        random[32]=          4e 7a 05 16 5a b5 10 30 3f 64 70 1c 4c 7a e1 6d          20 6e 12 31 a3 92 33 93 b3 1d 05 74 7a 61 b8 2f        cipher suites        Unknown value 0xff        TLS_RSA_WITH_RC4_128_SHA        compression methods                  NULL 2 2  0.0019 (0.0009)  S>CV3.1(53)  Handshake      ServerHello        Version 3.1        random[32]=          4e 7a 05 16 0e e1 6a d8 44 71 4f 56 b2 ef 67 67          27 06 76 93 2e 88 47 83 dc 9c 65 8b 78 9b 5d 65        session_id[0]=        cipherSuite         TLS_RSA_WITH_RC4_128_SHA        compressionMethod                   NULL 2 3  0.0019 (0.0000)  S>CV3.1(767)  Handshake      Certificate 2 4  0.0019 (0.0000)  S>CV3.1(4)  Handshake      ServerHelloDone 2 5  0.0584 (0.0564)  C>SV3.1(134)  Handshake      ClientKeyExchange        EncryptedPreMasterSecret[128]=          86 30 17 79 da 85 92 7c 28 98 b9 c8 9a 46 f2 23          6d 38 96 3a c8 f6 d7 a7 19 a8 81 d2 a0 7e 45 46          15 80 16 f3 d8 36 75 41 40 73 91 1c e9 33 1d 4f          da 2b a9 fb 50 1e 00 2d 30 14 99 b6 8d 36 5b d1          f7 ae 41 14 97 d3 36 a3 c2 9d 30 3a b3 f3 4b fe          79 0c a3 79 6a b6 38 fd 7d ab 66 29 33 c8 3d 1b          d8 35 19 00 de 16 89 78 7e 0e 17 bb 7c 67 b2 c7          06 c6 0d f8 df 8e b5 f8 47 9f 5b ab 02 70 08 42 2 6  0.0584 (0.0000)  C>SV3.1(1)  ChangeCipherSpec 2 7  0.0584 (0.0000)  C>SV3.1(36)  Handshake      Finished        verify_data[12]=          df 11 b4 22 6f 4b c7 c0 a9 da e6 3c 2 8  0.0621 (0.0037)  S>CV3.1(202)  Handshake      TLS_RSA_WITH_RC4_128_MD52 9  0.0621 (0.0000)  S>CV3.1(1)  ChangeCipherSpec 2 10 0.0621 (0.0000)  S>CV3.1(36)  Handshake      Finished        verify_data[12]=          89 e4 88 3c 04 27 3a 09 7a 9f 94 dd 2 11 0.0661 (0.0039)  C>SV3.1(372)  application_data    ---------------------------------------------------------------    GET /index.html HTTP/1.1    Host: 192.168.11.150    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8    Accept-Language: ja,en-us;q=0.7,en;q=0.3    Accept-Encoding: gzip, deflate    Accept-Charset: Shift_JIS,utf-8;q=0.7,*;q=0.7    Connection: keep-alive        --------------------------------------------------------------- 2 12 0.0670 (0.0009)  S>CV3.1(285)  application_data    ---------------------------------------------------------------    HTTP/1.1 200 OK    Date: Wed, 21 Sep 2011 15:39:02 GMT    Server: Apache/2.2.21 (Fedora)    Last-Modified: Wed, 21 Sep 2011 14:56:04 GMT    ETag: "80318-6-4ad74c67a39a9"    Accept-Ranges: bytes    Content-Length: 6    Connection: close    Content-Type: text/html; charset=UTF-8        --------------------------------------------------------------- 2 13 0.0670 (0.0000)  S>CV3.1(26)  application_data    ---------------------------------------------------------------    hello    --------------------------------------------------------------- 2 14 0.0670 (0.0000)  S>CV3.1(22)  Alert    level           warning    value           close_notify 2    0.0670 (0.0000)  S>C  TCP FIN 2 15 0.0678 (0.0007)  C>SV3.1(22)  Alert    level           warning    value           close_notify 2    0.0679 (0.0000)  C>S  TCP RST New TCP connection #3: hat1.local(48363) <-> f15.local(443) 3 1  0.0008 (0.0008)  C>SV3.1(277)  Handshake      ClientHello        Version 3.1        random[32]=          4e 7a 05 16 9c 6f 97 27 81 55 7b 33 46 e6 94 7a          4f 26 ab 93 a0 18 0b 24 f6 f3 20 fa 15 8a 2f 1f        resume [32]=          94 a7 49 4a 2e 80 cf 05 6e 7d af 2a e4 ec 77 17          6a 4a f4 24 ea 84 cc 98 e9 e3 0e cd 60 94 59 a7        cipher suites        Unknown value 0xff        TLS_RSA_WITH_RC4_128_SHA        compression methods                  NULL 3 2  0.0018 (0.0009)  S>CV3.1(81)  Handshake      ServerHello        Version 3.1        random[32]=          4e 7a 05 16 5b d0 98 fb 4c 8e a4 bc 70 b9 99 b7          f1 1c cb 87 b2 33 c4 ca c7 64 58 bf 62 49 97 78        session_id[32]=          94 a7 49 4a 2e 80 cf 05 6e 7d af 2a e4 ec 77 17          6a 4a f4 24 ea 84 cc 98 e9 e3 0e cd 60 94 59 a7        cipherSuite         TLS_RSA_WITH_RC4_128_SHA        compressionMethod                   NULL 3 3  0.0018 (0.0000)  S>CV3.1(1)  ChangeCipherSpec 3 4  0.0018 (0.0000)  S>CV3.1(36)  Handshake 3 5  0.0040 (0.0022)  C>SV3.1(1)  ChangeCipherSpec 3 6  0.0040 (0.0000)  C>SV3.1(36)  Handshake 3 7  0.0040 (0.0000)  C>SV3.1(343)  application_data 3 8  0.3194 (0.3153)  S>CV3.1(200)  application_data 3 9  0.3194 (0.0000)  S>CV3.1(310)  application_data 3 10 0.3194 (0.0000)  S>CV3.1(22)  Alert 3    0.3195 (0.0000)  S>C  TCP FIN 3 11 0.3201 (0.0006)  C>SV3.1(22)  Alert 3    0.3202 (0.0000)  C>S  TCP RST New TCP connection #4: hat1.local(48364) <-> f15.local(443) 4 1  0.0006 (0.0006)  C>SV3.1(277)  Handshake      ClientHello        Version 3.1        random[32]=          4e 7a 05 16 df 10 11 0e 6e 77 f8 3a 8d fa 84 05          03 4e f1 d7 73 4e ad e2 dd 58 ef 60 bb 59 8a e8        resume [32]=          94 a7 49 4a 2e 80 cf 05 6e 7d af 2a e4 ec 77 17          6a 4a f4 24 ea 84 cc 98 e9 e3 0e cd 60 94 59 a7        cipher suites        Unknown value 0xff        TLS_RSA_WITH_RC4_128_SHA        compression methods                  NULL 4 2  0.0015 (0.0009)  S>CV3.1(81)  Handshake      ServerHello        Version 3.1        random[32]=          4e 7a 05 16 7b bf 58 8f fc 3a 4b 10 cb 2d 48 7b          ef 1d fd 39 68 26 6f 4b 74 aa 26 5b ee 95 e8 87        session_id[32]=          94 a7 49 4a 2e 80 cf 05 6e 7d af 2a e4 ec 77 17          6a 4a f4 24 ea 84 cc 98 e9 e3 0e cd 60 94 59 a7        cipherSuite         TLS_RSA_WITH_RC4_128_SHA        compressionMethod                   NULL 4 3  0.0015 (0.0000)  S>CV3.1(1)  ChangeCipherSpec 4 4  0.0015 (0.0000)  S>CV3.1(36)  Handshake 4 5  0.0044 (0.0028)  C>SV3.1(1)  ChangeCipherSpec 4 6  0.0044 (0.0000)  C>SV3.1(36)  Handshake 4 7  0.0044 (0.0000)  C>SV3.1(373)  application_data 4 8  0.0054 (0.0009)  S>CV3.1(200)  application_data 4 9  0.0054 (0.0000)  S>CV3.1(310)  application_data 4 10 0.0054 (0.0000)  S>CV3.1(22)  Alert 4    0.0055 (0.0000)  S>C  TCP FIN 4 11 0.0060 (0.0005)  C>SV3.1(22)  Alert 4    0.0061 (0.0000)  C>S  TCP RST ^Croot@hat1:~#

on Fedora 15 , segmentation fault :(

[root@f15 ~]# ssldump -i eth0 -Ad -k /etc/pki/tls/private/localhost.key port 443 New TCP connection #1: 192.168.11.100(48362) <-> 192.168.11.150(443) 1 1  0.0010 (0.0010)  C>S V3.1(53)  Handshake      ClientHello        Version 3.1        random[32]=          4e 7a 05 16 5a b5 10 30 3f 64 70 1c 4c 7a e1 6d          20 6e 12 31 a3 92 33 93 b3 1d 05 74 7a 61 b8 2f        cipher suites        Unknown value 0xff        TLS_RSA_WITH_RC4_128_SHA        compression methods                  NULL 1 2  0.0014 (0.0004)  S>C V3.1(53)  Handshake      ServerHello        Version 3.1        random[32]=          4e 7a 05 16 0e e1 6a d8 44 71 4f 56 b2 ef 67 67          27 06 76 93 2e 88 47 83 dc 9c 65 8b 78 9b 5d 65        session_id[0]=        cipherSuite         TLS_RSA_WITH_RC4_128_SHA        compressionMethod                   NULL 1 3  0.0014 (0.0000)  S>C V3.1(767)  Handshake      Certificate 1 4  0.0014 (0.0000)  S>C V3.1(4)  Handshake      ServerHelloDone 1 5  0.0585 (0.0571)  C>S V3.1(134)  Handshake      ClientKeyExchange        EncryptedPreMasterSecret[128]=          86 30 17 79 da 85 92 7c 28 98 b9 c8 9a 46 f2 23          6d 38 96 3a c8 f6 d7 a7 19 a8 81 d2 a0 7e 45 46          15 80 16 f3 d8 36 75 41 40 73 91 1c e9 33 1d 4f          da 2b a9 fb 50 1e 00 2d 30 14 99 b6 8d 36 5b d1          f7 ae 41 14 97 d3 36 a3 c2 9d 30 3a b3 f3 4b fe          79 0c a3 79 6a b6 38 fd 7d ab 66 29 33 c8 3d 1b          d8 35 19 00 de 16 89 78 7e 0e 17 bb 7c 67 b2 c7          06 c6 0d f8 df 8e b5 f8 47 9f 5b ab 02 70 08 42 1 6  0.0585 (0.0000)  C>S V3.1(1)  ChangeCipherSpec 1 7  0.0585 (0.0000)  C>S V3.1(36)  Handshake      Finished        verify_data[12]=          df 11 b4 22 6f 4b c7 c0 a9 da e6 3c 1 8  0.0617 (0.0031)  S>C V3.1(202)  Handshake Segmentation fault (core dumped)