Skip to content

Instantly share code, notes, and snippets.

View ericlaw1979's full-sized avatar
💭
Working on Microsoft Web Defense

Eric Lawrence ericlaw1979

💭
Working on Microsoft Web Defense
159 followers · 5 following
View GitHub Profile
@ericlaw1979
ericlaw1979 / ImportHARAndAutoreply.js
Created October 17, 2018 18:20
FiddlerScript function to add a toolbar button that loads a HAR file and replaces the AutoResponder with rules that mimic the Sessions from the HAR.
BindUIButton("\uD83D\uDCCB AutoReply from HAR")
public static function DoHARAutoResponder() {
var ofd = new OpenFileDialog();
ofd.Filter = "HAR Files|*.har";
ofd.Title = "Select a HttpArchive";
if (ofd.ShowDialog() != DialogResult.OK) {
return false;
}
var oImportOptions = FiddlerObject.createDictionary();
@ericlaw1979
ericlaw1979 / InterceptTopLevelNavigations.js
Created October 17, 2018 17:32
Browser Extension code to intercept top-level navigations directly to audio/video files and instead navigate to a playback page that allows the user to play the response inside the browser itself.
// Note, you need to update the "permissions" section of your manifest.json
// to contain ["webRequest", "webRequestBlocking"]
// Watch for top-frame navigations directly to media files. If found, instead navigate to a player page.
browser.webRequest.onHeadersReceived.addListener(
function(details) {
// We don't care about redirects or error responses.
if (details.statusCode !== 200) return;
// Skip navigations that aren't to Audio/Video
@ericlaw1979
ericlaw1979 / Preferences.cs
Created October 15, 2018 21:02
https://blogs.msdn.microsoft.com/fiddler/2010/05/03/fiddler-new-features-the-preferences-system/
// Documentation at http://fiddler.wikidot.com/prefs
// This sample is provided "AS IS" and confers no warranties.
// You are granted a non-exclusive, worldwide, royalty-free license to reproduce this code,
// prepare derivative works, and distribute it or any derivative works that you create.
//
// TODO:
// Add an internal version of the indexer that will allow skipping notification of Event handlers and setting of Internal Prefs
using System;
using System.Collections.Specialized;
@ericlaw1979
ericlaw1979 / RunAsExplorer.nsi
Created October 11, 2018 12:06
Instruct Windows explorer to run an application using its own integrity level
; Run what we installed. Use a trick on Vista+ to run as non-Admin
GetDLLVersion "Kernel32.dll" $R0 $R1
IntOp $R2 $R0 >> 16
IntOp $R2 $R2 & 0x0000FFFF ; $R2 now contains major version
IntCmp $R2 6 is6 lessthan6 morethan6
is6:
morethan6:
exec '"$WINDIR\explorer.exe" "$INSTDIR\sr.exe"' ; We use Explorer to launch it to get it to run non-elevated
goto RanIt
@ericlaw1979
ericlaw1979 / RefreshEnvironment.pas
Created October 11, 2018 11:29
If the system PATH environment variable changes, we need to call an undocumented Windows Shell function to rebuild our own Environment block such that new consoles/apps we spawn will see the new PATH.
// Add to the Private section of your main form's type declaration.
Procedure WMSettingChange(Var MSG: TMessage); MESSAGE WM_SETTINGCHANGE;
// If the system PATH environment variable changes, we need to call an
// undocumented Windows Shell function to rebuild our own Environment
// block such that new consoles/apps we spawn will see the new PATH.
Procedure TMain.WMSettingChange(Var MSG: TMessage);
var hLib: THandle;
pfnRegenerate: Function (oldEnv: Pointer; regenCurrent: BOOL): BOOL; StdCall;
pNil: Pointer;
@ericlaw1979
ericlaw1979 / CSPAnalyzer.js
Created September 27, 2018 21:50
Create a CSP Analyzer Tab in Fiddler
// Note: This is for JScript.NET Mode FiddlerScript
// Click Rules > Customize Rules. Inside the HANDLERS class, add the following block:
public BindUITab("🚫 CSPAnalyzer", "<html>")
static function CSPReport(arrSess: Session[]):String {
if (arrSess.Length != 1) {
return "<!doctype html><html style=\"font-family: 'Segoe UI'; width:100%; height: 100%; background-color: #F1EDED\"><body style='align:center; vertical-align:middle'><div style=\"height: 100%; margin-top: 80px; text-align: center; vertical-align:middle;\" >Please select a single response to view details about its Content-Security-Policy.</div></body></html>";
}
@ericlaw1979
ericlaw1979 / CookieHammer.ms
Last active August 29, 2018 11:34
Hammer cookies by adding/replacing in a tight loop
import Meddler;
import System;
import System.Text;
import System.Net.Sockets;
import System.Windows.Forms;
// You can set options for this script using the format:
// ScriptOptions("StartURL" (where {$PORT} is autoreplaced by the Meddler port number), "Optional HTTPS Certificate Thumbprint", "Random # Seed")
// public ScriptOptions("https://localhost:{$PORT}/Test2", "fc ba fd cd 07 02 14 db a6 b7 ad 37 92 a9 65 0a 75 33 4f 9a", "1234")
class Handlers
@ericlaw1979
ericlaw1979 / RedirectTest.ms
Created July 31, 2018 15:24
https://blogs.msdn.microsoft.com/ieinternals/2011/08/19/http-methods-and-redirect-status-codes/
import Meddler;
import System;
import System.Net.Sockets;
import System.Windows.Forms;
class Handlers
{
static function OnConnection(oSession: Session)
{
if (oSession.ReadRequest()){
@ericlaw1979
ericlaw1979 / Toolbar and OnLoad.cs
Created May 9, 2018 20:55
public static void OnBoot()
{
var btn = new ToolStripButton("Boo");
btn.ToolTipText = "Haha";
FiddlerToolbar.AddToolStripItem(btn);
FiddlerApplication.OnLoadSAZ += myHandler;
}
public static void myHandler( System.Object o, Fiddler.FiddlerApplication.ReadSAZEventArgs RSEA) {
FiddlerApplication.UI.Text = "Latest: " + RSEA.sFilename;
@ericlaw1979
ericlaw1979 / HackyFiddlerScriptUITweaks.cs
Created May 4, 2018 19:01
Many components in Fiddler's UI are not "public", but because of how WinForms works, you can crawl around the window until you find them. This C# FiddlerScript makes the box at the bottom of the AutoResponder tab taller.
[ToolsAction("FixPanelHeight")]
public static void DoFix()
{
foreach (Control c in FiddlerApplication.UI.tabsViews.Controls) {
if (c.Name == "pageResponder") foreach (Control d in (c.Controls[0] as UserControl).Controls)
if (d.Name == "pnlAutoResponders") foreach (Control e in (d as Panel).Controls) {
// FiddlerApplication.Log.LogString(e.Name);
if (e.Name == "gbResponderEditor") {
e.Height=e.Height+120;
e.Top=e.Top-120;