CODEWITHSUNDEEP
httpscertificateserverfiddler
user4841702
user4841702

Reputation: 43

Is it possible for a server to see whether a HTTPS connection is monitored by Fiddler?

I'd like to know if it's possible for web services to detect HTTPS connections with "faked" root certificates created by Fiddler4 (Web debugging proxy) to prevent reverse engineering.

Is there any method to check whether the encryption is done with the original certificate or with one made by Fiddler?

Upvotes: 3

Views: 165

Answers (1)

EricLaw
EricLaw

Reputation: 57115

A server has no way to know what certificate the client received unless the client sends the server that information.

From client JavaScript, you cannot detect such interception today; JavaScript does not expose the capabilities to introspect the certificate. It is possible to use Java or Flash inside a webpage to inspect the certificate received upon connecting to a server, but a sufficiently devious interceptor could just avoid MITM'ing the Java/Flash connection.

In contrast, a native code client application can detect what certificate was presented by the server and reject any certificate that doesn't match the expected certificate; this is called certificate pinning and it's a technique used by some applications. Note that this will block more than Fiddler; it'll also block connections through corporate inspection proxies (e.g. BlueCoat, ISA TMG, etc) and through some popular consumer antivirus programs' proxies (e.g. BitDefender). More importantly, users can circumvent your certificate pinning checks if they like; your code is running on their device, and they have the ability to modify your code in memory to strip out your certificate pinning checks. On some mobile devices, this code modification requires "jail-breaking" the device, but this isn't an insurmountable barrier.

Upvotes: 6

Related Questions