使用Fiddler Proxy无法通过内部WebKit浏览器建立隧道解密HTTPS流量

核心问题 #

在越狱iPhone XR上使用Fiddler代理解密应用HTTPS流量时，应用常规功能请求可正常建立隧道，但内部WebKit模块的请求出现隧道建立失败（认证失败，远程关闭传输流）；更新SSL Kill Switch 2至最新版本后，证书问题解决，但请求多次后返回403错误，而Postman模拟相同请求始终返回200。

关键差异对比 #

从捕获的日志可看出成功与失败请求的核心区别：

• User-Agent：成功请求使用应用自定义UA，失败请求使用WebKit专属UA
• ALPN扩展：成功请求仅支持http/1.1，失败请求同时支持h2和http/1.1
• 握手结果：成功请求完成TLS握手并建立加密隧道，失败请求在隧道建立后触发SecureClientPipeDirect failed错误

成功建立隧道日志 #

CONNECT api.xxxxxxxxx.com:443 HTTP/1.1
Host: api.xxxxxxxx.com
User-Agent: Driver/1003.95.3.17728954 CFNetwork/1240.0.4 Darwin/20.6.0
Connection: keep-alive
Connection: keep-alive

A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.

Version: 3.3 (TLS/1.2)
Random: 53 36 A3 4D 40 7F 06 DC 59 EF 0D F2 67 BF 69 13 90 B3 40 A7 30 A1 14 54 E8 D0 ED 0D 99 78 66 05
"Time": 4/11/2011 1:11:47 PM
SessionID: 67 37 00 00 89 55 CA 97 B4 ED 1E 51 D3 52 84 D9 C0 95 92 E8 3E AA 22 59 39 ED EE 34 40 D5 26 96
Extensions: 
    grease (0xaaaa) empty
    server_name api.xxxxxxxx.com
    extended_master_secret  empty
    renegotiation_info  00
    supported_groups    grease [0xfafa], x25519 [0x1d], secp256r1 [0x17], secp384r1 [0x18], secp521r1 [0x19]
    ec_point_formats    uncompressed [0x0]
    ALPN        http/1.1
    status_request  OCSP - Implicit Responder
    signature_algs  ecdsa_secp256r1_sha256, rsa_pss_rsae_sha256, rsa_pkcs1_sha256, ecdsa_secp384r1_sha384, ecdsa_sha1, rsa_pss_rsae_sha384, rsa_pss_rsae_sha384, rsa_pkcs1_sha384, rsa_pss_rsae_sha512, rsa_pkcs1_sha512, rsa_pkcs1_sha1
    SignedCertTimestamp (RFC6962)   empty
    key_share   00 29 FA FA 00 01 00 00 1D 00 20 63 5F C7 E5 45 CB 0C 1B 17 34 69 DF B4 F5 98 0C 91 23 A5 D8 C0 17 C9 8D CC 70 B8 23 C7 79 67 1A
    psk_key_exchange_modes  01 01
    supported_versions  grease [0x2a2a], Tls1.3, Tls1.2
    grease (0xcaca) 00
    padding     214 null bytes
Ciphers: 
    [BABA]  Unrecognized cipher
    [1301]  TLS_AES_128_GCM_SHA256
    [1302]  TLS_AES_256_GCM_SHA384
    [1303]  TLS_CHACHA20_POLY1305_SHA256
    [C02C]  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    [C02B]  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    [CCA9]  TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
    [C030]  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    [C02F]  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    [CCA8]  TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
    [C024]  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
    [C023]  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
    [C00A]  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
    [C009]  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
    [C028]  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
    [C027]  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
    [C014]  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
    [C013]  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

Compression: 
    [00]    NO_COMPRESSION



HTTP/1.1 200 Connection Established
FiddlerGateway: Direct
StartTime: 08:53:48.980
Connection: close

Encrypted HTTPS traffic flows through this CONNECT tunnel. HTTPS Decryption is enabled in Fiddler, so decrypted sessions running in this tunnel will be shown in the Web Sessions list.

Secure Protocol: Tls12
Cipher: Aes128 128bits
Hash Algorithm: Sha256 ?bits
Key Exchange: ECDHE_RSA (0xae06) 255bits

== Server Certificate ==========
[Subject]
  CN=*.xxxxxx.com, O="Xxxxxx, Inc.", L=San Francisco, S=California, C=US

[Issuer]
  CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US

[Serial Number]
  0E5C9FB26125F869BF32DEFE4B26822E

[Not Before]
  6/13/2022 8:00:00 PM

[Not After]
  7/15/2023 7:59:59 PM

[Thumbprint]
  4F91631510EC84B84A195014E335B1C6748318AF

[SubjectAltNames]
*.xxxxxx.com, xxxxx.com, *.xxxxx.net, xxxxx.net, *.xxxxx.me, xxxxx.me, *.xxxxx.ca, xxxxx.ca, *.xxxxxxxxx.com, xxxxxxxx.com

失败建立隧道日志 #

CONNECT api.xxxxxx.com:443 HTTP/1.1
Host: api.xxxxxxx.com
User-Agent: com.apple.WebKit.Networking/8611.4.1.0.3 CFNetwork/1240.0.4 Darwin/20.6.0
Connection: keep-alive
Connection: keep-alive

A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.

Version: 3.3 (TLS/1.2)
Random: E2 EF 8D 53 08 4F D9 3E 23 DB BA 45 40 A6 A2 ED 6E 23 3B 84 C6 00 98 75 9F 03 5C 95 6C 7E 6B 1E
"Time": 6/3/2014 11:55:14 AM
SessionID: CA 79 37 63 83 57 8B E1 86 24 8F F0 18 FA A9 27 83 52 1E 5B BD 39 27 86 94 CB 54 68 7D 7B FD 3E
Extensions: 
    grease (0x1a1a) empty
    server_name api.xxxxxx.com
    extended_master_secret  empty
    renegotiation_info  00
    supported_groups    grease [0xcaca], x25519 [0x1d], secp256r1 [0x17], secp384r1 [0x18], secp521r1 [0x19]
    ec_point_formats    uncompressed [0x0]
    ALPN        h2, http/1.1
    status_request  OCSP - Implicit Responder
    signature_algs  ecdsa_secp256r1_sha256, rsa_pss_rsae_sha256, rsa_pkcs1_sha256, ecdsa_secp384r1_sha384, ecdsa_sha1, rsa_pss_rsae_sha384, rsa_pss_rsae_sha384, rsa_pkcs1_sha384, rsa_pss_rsae_sha512, rsa_pkcs1_sha512, rsa_pkcs1_sha1
    SignedCertTimestamp (RFC6962)   empty
    key_share   00 29 CA CA 00 01 00 00 1D 00 20 2C 81 5B 83 4E A9 2F E0 17 99 47 E1 51 C3 88 5E 6C 65 3C F6 FF FD DE BD B6 4F 3F 38 73 DB 1F 15
    psk_key_exchange_modes  01 01
    supported_versions  grease [0xdada], Tls1.3, Tls1.2
    grease (0x8a8a) 00
    padding     211 null bytes
Ciphers: 
    [EAEA]  Unrecognized cipher
    [1301]  TLS_AES_128_GCM_SHA256
    [1302]  TLS_AES_256_GCM_SHA384
    [1303]  TLS_CHACHA20_POLY1305_SHA256
    [C02C]  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    [C02B]  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    [CCA9]  TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
    [C030]  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    [C02F]  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    [CCA8]  TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
    [C024]  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
    [C023]  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
    [C00A]  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
    [C009]  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
    [C028]  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
    [C027]  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
    [C014]  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
    [C013]  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

Compression: 
    [00]    NO_COMPRESSION



HTTP/1.1 200 Connection Established
FiddlerGateway: Direct
StartTime: 08:53:46.605
Connection: close

Fiddler错误日志 #

08:53:46:7774 !SecureClientPipeDirect failed: System.IO.IOException Authentication failed because the remote party has closed the transport stream. for pipe (CN=*.xxxxxxx.com, O=DO_NOT_TRUST, OU=Created by http://www.fiddler2.com)

解决思路 #

一、WebKit隧道建立失败问题 #

1. 调整Fiddler的HTTP/2支持

   • Fiddler默认对HTTP/2的处理存在兼容性问题，可在Tools > Options > HTTPS > Advanced中取消勾选Allow HTTP/2，重启Fiddler后测试。
   • 若禁用无效，可在越狱环境下修改WebKit配置，强制其使用HTTP/1.1（修改对应plist文件或重启WebKit网络进程：killall com.apple.WebKit.Networking）。

2. 验证WebKit的证书信任

   • 确认Fiddler根证书已添加到iOS系统信任区（Settings > General > About > Certificate Trust Settings开启信任）。
   • 重启WebKit网络进程，确保SSL Kill Switch 2完全绕过WebKit的证书固定逻辑。

3. 匹配TLS握手参数

   • 打开Fiddler的Rules > Customize Rules，在OnBeforeTunnelRequest中添加代码，修改ALPN为h2, http/1.1，并同步WebKit的Cipher Suite列表，模拟原生握手参数。
   • 确保Fiddler使用的TLS版本与WebKit一致（TLS 1.2/1.3），避免版本不兼容。

二、更新SSL Kill Switch 2后的403问题 #

1. 匹配TLS指纹（JA3）

   • 服务器可能通过JA3指纹识别代理请求，可通过Mockttp捕获WebKit原生JA3值，再在Fiddler中通过自定义规则或插件修改JA3指纹，使其与原生一致。

2. 禁用Fiddler的自动请求头修改

   • Fiddler默认会添加X-Forwarded-For、Via等代理头，部分服务器会检测这些特征。在Customize Rules中添加代码移除这些头：

     if (oSession.oRequest.headers.Exists("X-Forwarded-For")) {
         oSession.oRequest.headers.Remove("X-Forwarded-For");
     }
     if (oSession.oRequest.headers.Exists("Via")) {
         oSession.oRequest.headers.Remove("Via");
     }
     

3. 校验会话与Cookie传递

   • 对比Fiddler和Postman的请求头，确保Cookie、Session ID完全一致，无丢失或篡改。可在Fiddler的Inspectors > Raw标签中查看并手动修正。
   • 清除应用缓存后重新测试，避免会话过期导致403。

内容的提问来源于stack exchange，提问作者Carlos