feat(fiddler): inspect native SAZ captures

Inspect bounded recorded raw HTTP/XML SAZ archives and page retained capture Evidence. Preserve exact stored bytes and provenance, validate ZIP/XML integrity, and require an enforceable decoder memory bound.

Verified 356 real recorded sessions against independent byte and metadata oracles, public CLI/MCP parity, retained pages, and related interface checks. Current Fiddler Everywhere GUI and non-Linux producer workflows remain unverified.

Co-authored-by: zahhak <1792039+zahhak@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
This commit is contained in:
authored and GitHub committed 2026-10-13 02:51:14 +00:00
1 parent f254f5ac2b
commit a2d8b94dd5
61 files changed
+2237 -285

No files matched your search

+1 -1
View File
@@ -4,7 +4,7 @@
in an existing capture. Network, USB or Bluetooth recordings can use the same
field/filter interface when the installed TShark supports their encapsulation
and dissectors. This tool does not acquire traffic, open an interface or control
a device. HAR/mitmproxy web-capture workflows remain separate.
a device. HAR/SAZ/mitmproxy web-capture workflows remain separate.
Supply an existing TShark 4.x installation **on Linux**, with util-linux
`prlimit` available at `/usr/bin/prlimit`. Override its absolute path with