Use Case:

This guide will go over configuring Fiddler to intercept traffic from mobile devices for debugging purposes.  This scenario can be beneficial in tracing/debugging SAML tokens issued from your IdP for a mobile application to consume.  We will be able to validate all traffic flowing in/from the Android device.

Configuring/Setting up Fiddler:

1. Grab the latest copy of Fiddler from their website for Windows (it is a free download)
   1. https://www.telerik.com/download/fiddler
2. Install Fiddler on your local machine
   1. Double click fiddlersetup.exe
      
   2. Agree to the End User License Agreement
      
   3. Set the installation directory and click Install
      
   4. Close the setup wizard
      
3. Launch Fiddler
   
4. Click Cancel if prompted about AppContainers
   
5. With Fiddler open click on Tools -> Telerik Fiddler Options...
   
6. Click on the Connections tab and check Allow remote computers to connect
   
   
7. You will receive a dialog box saying it will need to restart.  Click OK and close out of Fiddler
   
8. Once you relaunch Fiddler, click on the down arrow (if shown) and hover over the Online icon
   

At this point, Fiddler is configured properly, let's shift over to your mobile device. We'll shift gears to configuring the Android device to push traffic to Fiddler.

Configuring an Android device
(Android v6.0.1 at the time of writing)

1. Slide down the notifications drawer from the top of the screen and hit the Settings (gear) icon in the top right
2. Select Wi-Fi under the Wireless and networks section
   
3. Select the wireless network you are connected to and click Edit
   
   
4. Scroll down and check Show advanced options
   
   
5. Select the drop-down for Proxy and choose Manual
   
   
6. Type in the IP address gathered from Fiddler for the Proxy host name and set the Proxy Port to 8888 and click Save
   1. Note: 8888 is the default port for Fiddler, the port can be found under Fiddler -> Telerik Fiddler Options -> Connections tab
      
7. Next, open up your web browser and navigate to http://ipv4.fiddler:8888
   1. Note: This is a small webpage served by the Fiddler application to validate the proxy settings are correct.  Likewise, we will use this page in the next step for SSL decryption
      
8. On the Fiddler Echo Service page, click on the You can download the FiddlerRoot Certificate link
   1. Note: This download Fiddler's root certificate to allow us to intercept SSL traffic for debugging purposes
9. Once the certificate has downloaded, type Fiddler as the Certificate name and click OK
   
   
10. Optional step: Open up your web browser and navigate to a website using SSL (I did https://google.com)
    1. Note: Here you can validate that the SSL certificate used is Fiddler's root certificate.  This is a good sign that we are intercepting the traffic
       

Turn off Fiddler from intercepting SSL traffic

Remove the proxy settings

1. Slide down the notifications drawer from the top of the screen and hit the Settings (gear) icon in the top right
   
2. Select Wi-Fi under the Wireless and networks section
   
3. Select the wireless network you are connected to and click Edit
   
   
4. Scroll down and check Show advanced options (you should see your old proxy settings unlike my screenshot below)
   
   
5. Select the drop-down for Proxy and choose None
   
   
6. Select Save
   
7. At this point, you should be able to capture the traffic through the Fiddler application on your Windows machine; see the screenshot below showing traffic from the android device
   1. NOTE/TIP: If you turn off capturing, you will turn off capturing on Windows, but not for the mobile device.  This can help cut down on the "noise" in getting your sample/debug logs.
      

Remove the Fiddler SSL certificate

1. Slide down the notifications drawer from the top of the screen and hit the Settings (gear) icon in the top right
   
2. Select Security
   
   
3. Select Trusted credentials
   
   
4. Select the User tab on the Trusted credentials window
   
5. Scroll down through the certificate information and towards the bottom you will see a Remove button; press the REMOVE button.
   1. Note: You have to scroll the text, there is no scrollbar until you start the scrolling gesture