Repeating and intercepting one or more HTTP requests can be done in one click (just mark them and click ‘R’).Filtering of HTTP the requests / responses can be done in a few clicks.The history of the HTTP requests and the manipulated requests are in the same view.Most UI components are under the same view.It has a great UI and a set of shortcuts that makes the process super easy and efficient. Why Fiddler Is Best In The Evaluation Phaseįiddler is the best tool for the evaluation phase. You don’t want your tool getting in the way here. You don’t want to waste time moving between tabs or views – things that can distract your mind and slow down your process. All these ideas and assumptions need to be validated or disproved as quickly and smoothly as possible to be efficient. While some lead to really impressive exploitations. Some of them might be silly like an attempt to exploit an SSRF with gopher://. Hundreds of different ideas and assumptions start to fill my head during the evaluation phase. How do they prefer to index objects – GUID or sequence numbers?.How did the developers choose to pass input – REST or SOAP?.Are all of the APIs running on the same server?.Personally, this is my favorite part of the test – I try to feel more comfortable with the app by looking at the HTTP calls and asking myself questions, like: During the “drill in” process you should be continuously sniffing the app traffic with a web proxy. After getting a baseline of what the app does, you can drill in and focus on a specific area in the app.

The app is used as a regular user checking the main functions to get to know the business logic. In my mind, every good pentest starts with the “evaluation” phase. In order to fulfill the dynamic and flexible nature of the second type, you need the right “partner” – Fiddler. This is the stuff that gets me out of bed in the morning. The exploitation is out of the box, and the report usually leaves the client speechless. The “holy cow how did you do it” type – Findings are unique and exciting.The “banal” type – Findings are straightforward and most of the vulnerabilities uncovered could likely be found by automatic scanners.Let me share my philosophy about pentesting and why Fiddler is a perfect fit.Īfter a pentest, there are two types of reports you can present: I know some of you might think that Fiddler is a tool just for web developers and no good for security engineers.

Burp suite repeater send shortcut