Persistence With “Fiddler Classic” Extensions

Nasreddine Bencherchali
2 min readJun 16, 2022

Inspired by Rasta Mouse blog on Notepad++ Plugins for Persistence this blog talks about how to use Fidder Classic extensions/plugins as a persistence mechanism.

First a quick definition from the website:

Fiddler Classic and fiddler Everywhere are special-purpose proxy server tools for debugging web traffic from applications like browsers. They’re used to capture and record this web traffic and then forward it onto a web server

Similar to Notepad++ and many other applications out there in that Fiddler also allows the use of plugins to enhance the user’s experience and make the tool more full-featured. It also allows the ability to write a custom plugin/extension by writing a DLL and placing it in the scripts folder.

Here are the steps to create a simple plugin that loads “calc” as a POC (I’m not creative sorry).

  1. From VStudio create a new project and select “Class Library (.Net Framework).
  2. Once created we need to add “fiddler.exe” as a reference to the project. For that right-click on reference and browse for the location of the binary.
  3. Write the following code. (See this for more examples)

4. Compile it and copy it to the “script” folder of a fiddler installation.

5. (Re)start “Fiddler Classic” and notice your beautiful calc.

Loaded Calc

One thing to note is that the default installation for “Fiddler Classic” is “%localappdata% which is user-controlled :)

Default Install Location

That’s it for this quick post, thanks for reading. You can find me on Twitter @nas_bench

--

--

Nasreddine Bencherchali

I write about #Detection and #WindowsInternals. Follow https://github.com/nasbench/Misc-Research fore interesting Windows tidbits