• 
  

• Archives

  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • October 2012
  • January 2012
  • December 2011
  • October 2011
  • May 2011
  • February 2011
  • January 2011
  • December 2010
  • November 2010
  • October 2010
  • August 2010
  • July 2010
  • May 2010
  • February 2010
  • December 2009
  • November 2009
  • October 2009
  • August 2009
  • July 2009
  • May 2009
  • April 2009
  • March 2009
  • January 2009
  • September 2008
  • August 2008
  • June 2008
  • May 2008
  • April 2008
  • March 2008
  • February 2008
  • January 2008
  • December 2007
  • April 2007
  • February 2007
  • January 2007
  • December 2006
  • September 2006
  • June 2006

• Categories

  • Authentication (2)
  • Code Review (8)
  • Debugging (5)
  • Development (24)
  • Malware (6)
  • Nebulous (2)
  • News (33)
  • Privacy (3)
  • Reverse Engineering (4)
  • SDL (9)
  • Security Testing (39)
  • Tools (20)
  • Unicode (12)

Subscribe

• RSS Feed

Sometimes there’s a need to simply wipe all the cookies from an HTTP request.  Maybe you want to re-issue a request without cookies, or maybe you want to browse a list of URLs to test that authentication is being required on all of them.  The following FiddlerScript will create a new menu item, under Rules, in Fiddler.  It can be enabled or disabled easily from there.

There’s two parts to creating a new rule with a menu item, but as you can see there’s not a lot to it.  First off, add the following at the beginning of the “Handlers” class.  These two lines will name your rule “Wipe Cookies”, disable it by default, and set it up to show up under the Rules menu item.

public static RulesOption("Wipe Cookies")
var m_WipeCookies: boolean = false;

Then, enter the following into the “OnBeforeRequest” function.  This will ensure that when you enable this rule, but simply clicking it from the Rules menu, the Cookie header will be removed from the HTTP request.

if (m_WipeCookies) {
  if (oSession.oRequest.headers.Exists("Cookie")) {
    oSession.oRequest.headers.Remove("Cookie");
  }
}

As you can see adding custom rules via FiddlerScript is rather simple.  Happy bug hunting!

Tags: Fiddler

This entry was posted on Friday, January 11th, 2013 at 8:09 am and is filed under Development, Security Testing. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.