How to capture C++ libcurl traffic in Fiddler ?

December 12, 2018 Deb Haldar

One of the engineers on my team stopped by today with an interesting problem. He was switching the http network stack in our SDK from casablanca to libcurl and needed to see the traffic in Fiddler for debugging.

However, when he opened fiddler to capture the network traffic, he could only see the Tunneling happen.But the actual POST request was not captured. A sample screenshot of this situation is below.

Libcurl traffic not captured

It turns out that you can enable capture from libcurl in two simple steps.

1. Set Fiddler up to decrypt HTTP traffic.

2. Put a line of C++ code that sets libcurl to go through the fiddler proxy.

Set up Fiddler to decrypt https traffic

From the Fiddler title menu bar, click Tools -> Options

In the options window that pops up, click HTTPS tab and select

Decrypt https traffic” as shown in the image below.

Decrypt HTTPS Traffic In Fiddler

Set Curl Options to go through Fiddler proxy

After you initialize Curl, insert the following line of code before you make the curl request.

curl_easy_setopt(curl, CURLOPT_PROXY, “127.0.0.1:8888”);

Here’s the full code snippet I’m using to send a curl request to get Bing’s contents.

#include <stdio.h>
#include "include\curl\curl.h"

int main(void)
{
  CURL *curl;
  CURLcode res;

  curl = curl_easy_init();
  if (curl) {
    
    curl_easy_setopt(curl, CURLOPT_URL, "https://www.bing.com/");
    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, false);

    //Point the curl proxy to fiddler
    res = curl_easy_setopt(curl, CURLOPT_PROXY, "127.0.0.1:8888");

    /* Perform the request, res will get the return code */
    res = curl_easy_perform(curl);
    /* Check for errors */
    if (res != CURLE_OK)
      fprintf(stderr, "curl_easy_perform() failed: %s\n",
        curl_easy_strerror(res));

    /* always cleanup */
    curl_easy_cleanup(curl);
  }
  return 0;
}

And that’s it. Restart Fiddler and you should be able to capture the https traffic sent by your C++ Curl library.

An image of the captured traffic is below. Hope this helps.