Site icon Liquidmatrix Security Digest

HTTPREPLAY and STRACE

Microsoft has released a couple of new tools that allow users to trace HTTP traffic. Firefox has similar plugins Live HTTP Headers, Modify Headers and Tamper Data. The first one is called HTTPREPLAY.

HTTPREPLAY is a SOCKTRC plugin allowing to analyze and replay HTTP traffic from STRACE or WININET log. You can use this tool to “replay a web server” without needing to setup IIS. The main goal of this tool is to help building a repro scenario when customer can’t provide one.

The other half of this duo is STRACE.

STRACE is a socket/SSL tracer that is based on the “detours” utility. The tool has been specificaly designed to generate LOG for Intenet Explorer but it can be used with many other applications.

Using STRACE with Internet Explorer is equivalent to use a (non full) debug build of WININET.DLL to generate a WININET LOG. The STRACE LOG contains clear text HTTP traffic (with socket information) and encrypted/decrypted SSL data.

From the STRACE LOG, you can “replay” a full navigation scenario using the HTTPREPLAY tool. This can be useful to reproduce a problem or browse web sites offline…

Try them out.

Download HTTPREPLAY
Download STRACE

[tags]HTTPRELAY, STRACE, Tools, HTTP Analysis[/tags]

Exit mobile version