Search code examples
proxynetwork-programmingfiddlerhttp-proxy

Fiddler not capturing some connections

I'm trying to use Fiddler version 5.0.20202.18177 (latest as of writing) to determine the URLs used by various online / web installers.

This works fine in most cases. For example, with SpotifySetup.exe:

enter image description here

 

However, this does not work in some cases. For example, with DropboxInstaller.exe and bitdefender_online.exe:

enter image description here

enter image description here

 

I have ensured that:

  1. HTTPS decryption is set up for all processes: enter image description here
  2. All types of connections are being captured: enter image description here

  3. Windows' proxies are set as expected.

    enter image description here

  4. All Windows 10 AppContainer Loopback exemptions are in place: enter image description here

Running Fiddler as administrator doesn't make a difference.

I would have guessed that the executables simply aren't utilising the proxy but, as far as I'm aware, if the proxy is set at the Windows level then they can't override that?

Solution

  • After my discussion with Robert, I ended up abandoning Fiddler, setting up a VirtualBox VM running pfSense Community Edition (free) + Squid3 with HTTPS Interception and Access Logging, installing the pfSense's root CA certificate in my test Windows VM, and changing my test Windows VM's default gateway to the LAN IP address of the pfSense which worked.

    In the case of the Dropbox example, it was initially logging TCP_TUNNEL_ABORTED/200 client.dropbox.com:443 so I added client.dropbox.com to the whitelist in the ACLs then it worked and I could see the full EXE URL: enter image description here