Fiddler: Reconstructing files - fiddler

I am recording sessions to malicious websites using Fiddler and want to be able to reconstruct malware dropped by the website onto a victim machine. Does Fiddler have this capability inbuilt? Suggestions for other tools that could achieve this with the Fiddler saz file are welcome.

It seems Fiddler saves any files that are part of a successful download in the session. It can be viewed by right clicking on the request -> Inspect in new Window -> Response -> Textview.
Clicking on the dotted icon at the bottom right of this window saves the file in the IE temp folder. Alternatively, it can be saved to the desired location.

Related

Can I upload a file to onedrive via Windows 10 command line?

I need to upload a file to OneDrive, via the command line. This will be done through a batch file which is distributed to end users.
From searching on Stack Overflow, I find questions like this one which say that you need to register an app and create an app password, using Azure. I don't have the necessary permissions to do this in the organization where I work, nor can I do anything that requires an admin account. So I can't any install software - I have to use what comes with Windows 10. I can't use VBA either as that's blocked.
I've managed to download files from OneDrive without anything like that, using the process described here:
Open the URL in either of the browser.
Open Developer options using Ctrl+Shift+I.
Go to Network tab.
Now click on download. Saving file isn’t required. We only need the network activity while browser requests the file from the server.
A new entry will appear which would look like “download.aspx?…”.
Right click on that and Copy → Copy as cURL.
Paste the copied content directly in the terminal and append ‘--output file.extension’ to save the content in file.extension since
terminal isn’t capable of showing binary data.
Example:
curl https://xyz.sharepoint.com/personal/someting/_layouts/15/download.aspx?UniqueId=cefb6082%2D696e%2D4f23%2D8c7a%2
…. some long text ….
cCtHR3NuTy82bWFtN1JBRXNlV2ZmekZOdWp3cFRsNTdJdjE2c2syZmxQamhGWnMwdkFBeXZlNWx2UkxDTkJic2hycGNGazVSTnJGUnY1Y1d0WjF5SDJMWHBqTjRmcUNUUWJxVnZYb1JjRG1WbEtjK0VIVWx2clBDQWNyZldid1R3PT08L1NQPg==;
cucg=1’ --compressed --output file.extension
I tried to do something similar after clicking 'upload' on the browser, but didn't find anything useful when trying to filter the requests.
I found these two questions but there is no keyboard shortcut to upload, AFAICT. Also the end user will be uploading a file to a folder I've shared with them from my OneDrive. Opening Chrome or Edge as a minimised window is fine, but I can't just shove a window in their face which automatically clicks on things - they won't like that.
It's just occurred to me that I might be able to use an office application to Save As the file to the necessary onedrive folder, where the keyboard shortcuts are pretty stable, but have no idea how to achieve that via the command line.
The best and more secure way to accomplish this goal I think is going to be with the Rest API for OneDrive.
(Small Files <4MB)
https://learn.microsoft.com/en-us/onedrive/developer/rest-api/api/driveitem_put_content?view=odsp-graph-online
(Large files)
https://learn.microsoft.com/en-us/onedrive/developer/rest-api/api/driveitem_createuploadsession?view=odsp-graph-online
You still need a Azure AD App Registration (which your admin should be able to configure for you), to provide API access to services in Azure. Coding with the API is going to be far easier and less complicated, not to mention more versatile.

How to capture network info in Chrome devtools when clicking a link pop up a new download tab and closed right away?

I’m trying to use chrome devtools to see what network requests are.
But for some links, a new tab will be created for downloading a file and once the file is downloaded the tab is immediately closed.
There is no time to for me to inspect what the network requests are involved in the new tab. Is there a way to force the download in the original window so that I can still see the network activity?
As this answer suggest, yo may want to use chrome net export using chrome://net-export/
How it works?
You open a new tab and enter chrome://net-export/
Press the start logging to disk button and select a file
Do whatever
Press the stop recording button and inspect the file (should be formatted to be readable)
How to reproduce?
function popup() {
window.open('https://google.com', '_blank')
}
<button onclick="popup()">
click me
</button>
You will get WAY more information than you wished for, so - be patient when going over all the traffic details and also - make your recording as targeted and short as possible
Enjoy
EDIT
#Nathan raises a fair point in the comment - this method is not visual. a tool that may help to visualize the data is netlog viewer
Use the link, press the choose file button and upload your json file
In the left menu select events - this will display all events in a big table
Filter table by using URL_REQUEST or
Click each item to inspect and get detailed information (such as: url, headers, method, etc.)
There are other cool tools there (such as timeline) but it is different from chrome dev tools. This solution is just another set of tools for developers, that's all

Is there a way to programmatically open a server-side file in a new tab?

I'm running Jupyter notebook on a server and executing it from a client computer. In Rstudio server, one can programmably open a server-side file in a new tab via file.show. This is sometimes very convenient. For example, I have a script that processes a rather large image. Because of its size I don't want it to show directly in the output panel, rather I want to view it in a new tab. In Rstudio server I would normally do:
... image processing code ....
ggsave('temp.png')
file.show('temp.png')
This will automatically pop up the new image in a new tab once the script is finished.
Is it possible to do something similar in Jupyter?
I noticed that I could achieve this by clicking the image file in the built-in file browser, but I wonder if this could be programmed.
Similarly, is it possible to programmably open a webpage in a new tab like browseURL in Rstudio server? Note that webbrowser.open(url) doesn't quite do it because it tries to open a local browser, which in the server-client scenario will not open the new tab on the client side.
You can make a link. Relative URLs will open in a new browser tab. Files are served relative to the directory containing the notebook you are currently working on.
In Python:
from IPython.display import display, HTML
display(HTML('see image'))
Opening new tabs programmatically often triggers pop-up blockers, but publishing a link that the user clicks should be reliable.

Download attachments without browser

Does anybody know if it's possible to attach a big file to an e-mail and open it without opening a browser window? I mean, if I attach a small file, the file goes with the e-mail and I can open it without nothing more than the e-mail application. But when it's a big file (let's say 200Mb) normally I upload the file to an FTP, Dropbox, or other internet services. My client receives an e-mail with a link, and when he opens it, it starts a browser and he needs to click a link there to finally download the file. I would want to do that automatically, so my client only needs to click the link (or maybe drag'n drop) and it automatically downloads the attachment with no browser windows.
Do you think it's possible somehow? No problem if I need any programming language. Thanks in advance
It's not possible.
It would imply the use of Javascript that's not allowed in mail clients.

How to export data from Chrome developer tool?

Network analysis by Chrome when page loads
I would like to export this data to Microsoft Excel so that I will have a list of similar data when loaded at different times. Loading a page one time doesn't really tell me much especially if I want to compare pages.
if you right click on any of the rows you can export the item or the entire data set as HAR which appears to be a JSON format.
It shouldn't be terribly difficult to script up something to transform that to a csv if you really need it in excel, but if you're already scripting you might as well just use the script to ask your questions of the data.
If anyone knows how to drive the "load page, export data" part of the process from the command line I'd be quite interested in hearing how
from Chrome 76, you have Import/Export buttons.
I was trying to copy the size data measured from Chrome Network and stumbled on this post. I just found an easier way to "export" the data out to excel which is to copy the table and paste to excel.
The trick is click Control + A (select all) and once the entire table will be highlighted, paste it to Microsoft Excel. The only issue is if there are too many fields, not all rows are copied and you might have to copy and paste several times.
UPDATED: I found that copying the data only works when I turn off the filter options (the funnel-looking button above the table). – bendur
Right-click and export as HAR, then view it using Jan Odvarko's HAR Viewer
This helps in visualising the already captured HAR logs.
I came across the same problem, and found that easier way is to undock the developer tool's video to a separate window! (Using the right hand top corner toolbar button of developer tools window)
and in the new window , simply say select all and copy and paste to excel!!
In Chrome, in the Developer Tools, under Network, in the Name column, right-click and select "Save as HAR with content". Then open a new tab, go to https://toolbox.googleapps.com/apps/har_analyzer/ and open the saved HAR file.
Note that &Lt;Copy all as HAR&Gt; does not contain response body.
You can get response body via &Lt;Save as HAR with Content&Gt;, but it breaks if you have any more than a trivial amount of logs (I tried once with only 8k requests and it doesn't work.) To solve this, you can script an output yourself using _request.contentData().
When there's too many logs, even _request.contentData() and &Lt;Copy response&Gt; would fail, hopefully they would fix this problem. Until then, inspecting any more than a trivial amount of network logs cannot be properly done with Chrome Network Inspector and its best to use another tool.
You can use fiddler web debugger to import the HAR and then it is very easy from their on... Ctrl+A (select all) then Ctrl+c (copy summary) then paste in excel and have fun
I don't see an export or save as option.
I filtered out all the unwanted requests using -.css -.js -.woff then right clicked on one of the requests then Copy > Copy all as HAR
Then pasted the content into a text editor and saved it.
I had same issue for which I came here. With some trials, I figured out for copying multiple pages of chrome data as in the question I zoomed out till I got all the data in one page, that is, without scroll, with very small font size. Now copy and paste that in excel which copies all the records and in normal font.
This is good for few pages of data I think.
In more modern versions of Chrome you can just drag a .har file into the network tab of Chrome Dev Tools to load it.
To get this in excel or csv format- right click the folder and select "copy response"- paste to excel and use text to columns.
You can try use Haiphen, which is a chrome extension that allows you to analyze network traffic and what API calls a web application is making.