C# intercepting network traffic

[29]

Hey! I want to make a program which catches an applications requests in real time and auto replies to them with modified responses. Anyone got any idea how would I go with that in c#?

By this I mean something like http debugger pro's/fiddler's auto reply.

[235]

you could setup a webserver on localhost which forwards all the traffic you arent interested in and modifies the traffic you are interested in. you could set your system proxy to point at this webserver so that most application's requests will be sent to it.

however, if an application uses https this will not work as the application will see that your webserver doesnt have trusted certificates and wont connect to it. there are work arounds for this, but it doesnt always end up working.

also, some applications bypass the system proxy so it can be harder to get them to make requests to your webserver instead of their real targets.

[29]

you could setup a webserver on localhost which forwards all the traffic you arent interested in and modifies the traffic you are interested in. you could set your system proxy to point at this webserver so that most application's requests will be sent to it.

however, if an application uses https this will not work as the application will see that your webserver doesnt have trusted certificates and wont connect to it. there are work arounds for this, but it doesnt always end up working.

also, some applications bypass the system proxy so it can be harder to get them to make requests to your webserver instead of their real targets.

I found fiddlercore, made some code, if i make a request manually to the target i get hte modified response, but when the software does the request it stays the same, fiddlercore got a cert, but fiddler everywhere not even showing the request meanwhile http debugger pro does, and can bypass with that, but I really need the c# way, not debuggers. Here's my code, did I fuck up the code?

Code:

using System;
using System.Text;
using System.Threading.Tasks;
using Fiddler;

namespace FiddlerCore_ModifyResponse
{
    class Program
    {
        static async Task Main(string[] args)
        {
          
            FiddlerApplication.Prefs.SetBoolPref("fiddler.certmaker.bc.Debug", true);

            BCCertMaker.BCCertMaker certProvider = new BCCertMaker.BCCertMaker();
            CertMaker.oCertProvider = certProvider;
            FiddlerApplication.ResponseHeadersAvailable += FiddlerApplication_ResponseHeadersAvailable;

            Fiddler.FiddlerApplication.BeforeResponse += FiddlerApplication_BeforeResponse;
            

        

            FiddlerCoreStartupSettings startupSettings =
                                            new FiddlerCoreStartupSettingsBuilder()
                                                .ListenOnPort(8887)
                                                .DecryptSSL()
                                                .RegisterAsSystemProxy()
                                                .Build();


            FiddlerApplication.Startup(startupSettings);
            Console.WriteLine("\nPROXY set, waiting for request");
            Console.WriteLine("enter to remove proxy");

            Console.ReadLine();
            FiddlerApplication.Shutdown();
        }


        private static void FiddlerApplication_BeforeResponse(Session oSession)
        {

          


            if (oSession.fullUrl.Contains("xyz"))
            {
                oSession.bBufferResponse = true;
                oSession.utilDecodeResponse();

              
                oSession.utilDecodeResponse();
                var oBody = System.Text.Encoding.UTF8.GetString(oSession.responseBodyBytes);
              
                oBody = "522b349923da5dc131887d";
              
                oSession.utilSetResponseBody(oBody);
            }
  
        }

        

        private static void FiddlerApplication_ResponseHeadersAvailable(Session oSession)
        {

            if (oSession.fullUrl.Contains("xyz"))
            {
                oSession.bBufferResponse = true;
            }
        }
    }
}