views:

128

answers:

1

Hi, I need to be able to monitor all requests (HTTP & HTTPS) going out of IE. I am only interested in the headers and the cookies, so that I don't need to decrypt the SSL encrypted body. But I don't see a way of setting FiddlerCore as a proxy for HTTPS without enabling decryptSSL.

Thanks, Alex

+3  A: 

In HTTPS everything is encrypted: query string, headers, cookies, body and everything. So you cannot view the headers and cookies without decrypting everything anyway.

Dean Harding
Correct. FiddlerCore can be used to proxy SSL traffic without decrypting it (that's the default config, IIRC), but that won't provide you with access to the encrypted HTTPS headers.
EricLaw -MSFT-
Alex Skorohod
I don't know, but I assume it works the same way: by decrypting the entire request/response.
Dean Harding
HTTPAnalyzer thunks the network stack after decryption, and simply examines the network traffic in your computer's memory.
EricLaw -MSFT-