A framework based on the Fiddler web debugger to study Exploit Kits, malvertising and malicious traffic in general.
https://www.telerik.com/fiddler
Special instructions for Linux and Mac here:
https://www.telerik.com/blogs/fiddler-for-linux-beta-is-here
https://www.telerik.com/blogs/introducing-fiddler-for-os-x-beta-1
Launch Fiddler, and go to Tools -> Options
In the Scripting tab, change the default (JScript.NET) to C#.
In the same Tools -> Options menu, click on the Tools tab.
- Windows:
notepad.exeornotepad++.exe - Linux:
gedit - Mac:
/Applications/TextEdit.appor/Applications/TextWrangler.app
Close Fiddler
-
Windows (7/10)
C:\Users\[username]\Documents\Fiddler2\Scripts\ -
Ubuntu
/home/[username]/Fiddler2/Scripts/ -
Mac
/Users/[username]/Fiddler2/Scripts/
Start Fiddler to complete the installation of EKFiddle. That's it, you're all set!
The added toolbar buttons give you quick shortcuts to some of the main features:
Dumps current web sessions into a SAZ named (QuickSave-"MM-dd-yyyy-HH-mm-ss".saz) to EKFiddle\Captures.
VPN GUI directly built into Fiddler. It uses the OpenVPN client on Windows and Linux with ovpn files (sigining up with commercial VPN provider may be required). It will open up a new terminal/xterm whenever it connects to a new server via the selected .ovpn config file, killing the previous to ensure only one TAP adapter is used at any given time.
- Windows
Download and install OpenVPN in default directory
Place your .ovpn files inside OpenVPN's config folder.
- Linux (tested on Ubuntu 16.04)
sudo apt-get install openvpn
Place your .ovpn files in /etc/openvpn.
A shortcut to load SAZ (Fiddler's native format) or PCAP (i.e. from Wireshark) captures.
View and create your custom regular expressions. Note: a master list is provided with auto-updates via GitHub. Additionally the custom list lets you create your own rules.
Run the master and custom regular expressions against current web sessions.
Clear any comment and colour highlighting in the currently loaded sessions.
Toggle between the default column view or extra columns with additional information (includes time stamp, server IP and type, method, etc.).
The ContextAction menu (accessed by right-clicking on any session(s) allows you to perform additional commands on selected sections. This can be very helpful to do quick lookups, compute hashes or extract IOCs.
Query the hostname for the currently selected session.
Create a regular expression from the currently selected URI. This action opens up a regex website and the URI is already in the clipboard, ready to be pasted into the query field.
This opens up the URI with the browser you selected.
Decodes the currently selected sessions (from their basic encoding).
Create a regular expression from the currently selected session's source code. This action opens up a regex website and the URI is already in the clipboard, ready to be pasted into the query field.
Get the current session's body and computes its hash.
Checks the current session's body for hash, then look up that hash.
Downloads the currently selection session(s)'s body to disk, into the 'Artifacts' folder.
Copies into memory basic information from selected sessions so that they can be shared as IOCs.
Allows you to identify the sequence of events between sessions. Right-clik on the session you are interested in retracing your steps to and simply 'connect the dots'. It will label the sequence of events from 01, to n within the comments column. You can reorder that column to have a condensed view of the sequence.
Delete CustomRules.cs