AppSecEnterprise Architecture

Proxy Fiddler Through Burp

I am testing an application that only works on Internet Explorer in compatibility mode.  Before you laugh, it's is EXACTLY these legacy applications that get us into trouble, and they should be tested regularly, and they can be secured using compensating controls.  However, I am on the client's computer, which has enterprise controls on the proxy, which means I can't easily configure IE to use Burp because it uses the system proxy.

Fiddler, however, traps WinINET so it will see the traffic from IE, even with the proxy set to the corporate settings.  Fiddler is only an average-at-best security testing tool though, so I would like to use Burp too. The solution is to chain the proxies, and all of the instructions I am reading online are out of date. Because of this I thought I would add to the corpus because it is quite simple these days.

First it is important to know that Burp Suite listens on localhost, port 8080.  This is what you need to set your browser to in order to have the requests and responses filtered through Burp. We can leave these settings as default.

Fiddler's proxy is localhost, 8888, but that doesn't matter on Windows.  Since it listens on the network channel, we don't have to do anything - Fiddler "Just Works (tm)." You can leave these settings default as well.

The "Gateway" tab in the Options dialog has settings to proxy Fiddler outbound.  It will probably be set to System settings, as it should, but we are going to change that for this exercise.  Just like you would normally do in Chrome, set the proxy to manual, and set the values to localhost, 8080.  (Remember 127.0.0.1 is localhost)

That's it! Now every request and response will go through Fiddler and Burp.  Note that some of your enterprise applications might notice the proxy change and stop working, but at least you can get through your test.  Happy hacking!

Comments are closed
Mastodon