Persistence With “Fiddler Classic” Extensions

Inspired by Rasta Mouse blog on Notepad++ Plugins for Persistence this blog talks about how to use Fidder Classic extensions/plugins as a persistence mechanism.

First a quick definition from the website:

Fiddler Classic and fiddler Everywhere are special-purpose proxy server tools for debugging web traffic from applications like browsers. They’re used to capture and record this web traffic and then forward it onto a web server

Similar to Notepad++ and many other applications out there in that Fiddler also allows the use of plugins to enhance the user’s experience and make the tool more full-featured. It also allows the ability to write a custom plugin/extension by writing a DLL and placing it in the scripts folder.

Here are the steps to create a simple plugin that loads “calc” as a POC (I’m not creative sorry).

  1. From VStudio create a new project and select “Class Library (.Net Framework).
  2. Once created we need to add “fiddler.exe” as a reference to the project. For that right-click on reference and browse for the location of the binary.
  3. Write the following code. (See this for more examples)

4. Compile it and copy it to the “script” folder of a fiddler installation.

5. (Re)start “Fiddler Classic” and notice your beautiful calc.

One thing to note is that the default installation for “Fiddler Classic” is “%localappdata% which is user-controlled :)

That’s it for this quick post, thanks for reading. You can find me on Twitter @nas_bench



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Nasreddine Bencherchali

I write about #ThreatHunting #WindowsInternals #Malware #DFIR and occasionally #Python.