使用Fiddler能否篡改Python Requests模块的请求返回结果？

Great question! The short answer is yes—it’s absolutely possible for Fiddler to tamper with the responses your Requests module receives. Let me break down how this works and the scenarios where it can happen:

How Fiddler Intercepts and Alters Traffic #

• System Proxy Defaults: Requests automatically uses your system’s proxy settings by default. If Fiddler is running and set as your system-wide proxy (which it does by default when launched), every HTTP/HTTPS request sent via Requests will pass through Fiddler. This gives Fiddler full control to inspect, edit, or replace the response before it reaches your code.
• Forced Proxy Configuration: An attacker with access to your code or runtime environment could explicitly route Requests traffic through Fiddler. For example, adding this snippet to your code would funnel all requests through Fiddler’s default port:

  proxies = {"http": "http://127.0.0.1:8888", "https": "http://127.0.0.1:8888"}
  requests.get("https://example.com", proxies=proxies)
  

• HTTPS Man-in-the-Middle Attacks: For encrypted HTTPS traffic, Fiddler uses a self-signed root certificate to decrypt and re-encrypt traffic. If this certificate is trusted by your Python environment (either installed system-wide or added to Python’s certificate store), Fiddler can modify the response content, re-encrypt it, and send it to your client—all without your code noticing anything suspicious (unless you explicitly validate the server’s certificate chain).

How to Reduce This Risk #

• Control Proxy Settings: Avoid relying on system-wide proxies unless necessary. Explicitly define proxies in your code only when you need them.
• Never Disable SSL Verification: Resist the urge to use verify=False in Requests (unless you’re in a controlled testing setup). This ensures your client only trusts legitimate, verified server certificates.
• Limit Trusted Certificates: Be careful about installing unknown root certificates on your system or Python environment. Only add certificates from sources you fully trust.

内容的提问来源于stack exchange，提问作者Menace