Fiddler is a HTTP debugging proxy. Although it is easy to use (a very good thing!), it is also very powerful. Point in case and why I am writing about it today is that I stumbled across a drive-by-download site (stumble is the wrong word, the URL came with what seemed like a phishing mail and that piqued my interest):
That site is actually quite clever though: when you go there the second time, it detects that it tried to infect you before and tells you that your IP is blocked. And it doesn't send a peep to a browser other than IE. Plus - and that takes the biscuit - it also verifies the referer.
But I still wanted the code, so I reset my router and started Fiddler:
Although Fiddler has tons more features, this did the trick for me in this case (if you want to learn what Fiddler can do, look here).
So what's the obfuscated script about? The short version: it is a variant of the ASUS download server drive-by download incident. The actual code can be found in a discussion on our German .NET community site here.
The video recordings for the main tracks of FOSDEM 2007 are online now. Of interest for .NET developers might be Miguel's session on "Turbocharging Linux with Mono".