POST

HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (Compatible; MSIE 4.0b2; Update; Windows 95)
Host: sexyg4m3rz.net
Content-Length: 27
Pragma: no-cache
id=panamajoe&passwd=#######
HTTP/1.1 200 OK
Date: Fri, 22 Sep 2017 00:05:31 GMT
Server: Apache/2.4.10 (Win32) OpenSSL/1.0.1h PHP/5.4.31
X-Powered-By: PHP/5.4.31
Accept-Ranges: bytes
Content-Length: 4
Content-Type: text/html
-202
------------------------------------------------------------------
POST

HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (Compatible; MSIE 4.0b2; Update; Windows 95)
Host: sexyg4m3rz.net
Content-Length: 94
Pragma: no-cache
id=panamajoe&passwd=P0pt4rt&ver=1,0,4,905&test=0&c ode=0&pcode=b03883672e20ab1e13aebb08a2b2d403
HTTP/1.1 200 OK
Date: Fri, 22 Sep 2017 00:05:32 GMT
Server: Apache/2.4.10 (Win32) OpenSSL/1.0.1h PHP/5.4.31
X-Powered-By: PHP/5.4.31
Accept-Ranges: bytes
Content-Length: 59
Content-Type: text/html
D4DBE45F-9F45-4115-9196-98BA6F6A4C73|200147|RH_4.1.0.0|10|0
------------------------------------------------------------------
CONNECT 62.128.100.163:443 HTTP/1.1
Host: 62.128.100.163:443
After the client received notice of the established CONNECT, it failed to send any data.
HTTP/1.1 200 Connection Established
FiddlerGateway: Direct
StartTime: 12:13:11.669
Connection: close
------------------------------------------------------------------
POST

) HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (Compatible; MSIE 4.0b2; Update; Windows 95)
Host: sexyg4m3rz.net
Content-Length: 0
Pragma: no-cache
HTTP/1.1 200 OK
Date: Fri, 22 Sep 2017 00:05:32 GMT
Server: Apache/2.4.10 (Win32) OpenSSL/1.0.1h PHP/5.4.31
X-Powered-By: PHP/5.4.31
Accept-Ranges: bytes
Content-Length: 218
Content-Type: text/html
Inferno Developmen|185.44.76.40|22199|3|3|0|0|0|0|Ping: 33 MS(Full/1000)|Event exp 500%|185.44.76.40|22112|3|3|1|0|0|0|Ping: 33 MS (Light/1000)|Inferno Developmen|185.44.76.40|22199|3|3|0|0|0|1|Test Server (Light/100)|
------------------------------------------------------------------
CONNECT bolt.dropbox.com:443 HTTP/1.1
Host: bolt.dropbox.com
Connection: keep-alive
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.3 (TLS/1.2)
Random: F9 8B 14 4A 7E DE F3 FC F6 EF C5 1B 8E AD 90 53 F6 6B F9 4A F6 38 A8 2A FA 20 CB D4 3A FB 85 C7
"Time": 5/20/2009 7:02:17 PM
SessionID: empty
Extensions:
server_name bolt.dropbox.com
ec_point_formats uncompressed [0x0], ansiX962_compressed_prime [0x1], ansiX962_compressed_char2 [0x2]
elliptic_curves secp256r1 [0x17], secp521r1 [0x19], unknown [0x1C), unknown [0x1B), secp384r1 [0x18], unknown [0x1A), secp256k1 [0x16], sect571r1 [0xE], sect571k1 [0xD], sect409k1 [0xB], sect409r1 [0xC], sect283k1 [0x9], sect283r1 [0xA]
SessionTicket empty
signature_algs sha512_rsa, sha512_dsa, sha512_ecdsa, sha384_rsa, sha384_dsa, sha384_ecdsa, sha256_rsa, sha256_dsa, sha256_ecdsa, sha224_rsa, sha224_dsa, sha224_ecdsa, sha1_rsa, sha1_dsa, sha1_ecdsa
Ciphers:
[C030] TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[C028] TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
[C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
[C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[C027] TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
[C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
[009F] TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
[006B] TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
[0039] TLS_DHE_RSA_WITH_AES_256_SHA
[009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
[0067] TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
[0033] TLS_DHE_RSA_WITH_AES_128_SHA
[00FF] TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Compression:
[00] NO_COMPRESSION
HTTP/1.1 200 Connection Established
FiddlerGateway: Direct
StartTime: 12:13:26.073
Connection: close
------------------------------------------------------------------
CONNECT bolt.dropbox.com:443 HTTP/1.1
Host: bolt.dropbox.com
Connection: keep-alive
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.3 (TLS/1.2)
Random: F0 A6 49 43 9D 56 82 A4 7B 3C 75 D4 AB 6E 74 E2 14 ED 2E 14 0C EF 26 13 7B 41 19 F2 C8 55 A5 56
"Time": 10/9/2005 7:25:36 PM
SessionID: empty
Extensions:
server_name bolt.dropbox.com
ec_point_formats uncompressed [0x0], ansiX962_compressed_prime [0x1], ansiX962_compressed_char2 [0x2]
elliptic_curves secp256r1 [0x17], secp521r1 [0x19], unknown [0x1C), unknown [0x1B), secp384r1 [0x18], unknown [0x1A), secp256k1 [0x16], sect571r1 [0xE], sect571k1 [0xD], sect409k1 [0xB], sect409r1 [0xC], sect283k1 [0x9], sect283r1 [0xA]
SessionTicket empty
signature_algs sha512_rsa, sha512_dsa, sha512_ecdsa, sha384_rsa, sha384_dsa, sha384_ecdsa, sha256_rsa, sha256_dsa, sha256_ecdsa, sha224_rsa, sha224_dsa, sha224_ecdsa, sha1_rsa, sha1_dsa, sha1_ecdsa
Ciphers:
[C030] TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[C028] TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
[C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
[C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[C027] TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
[C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
[009F] TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
[006B] TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
[0039] TLS_DHE_RSA_WITH_AES_256_SHA
[009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
[0067] TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
[0033] TLS_DHE_RSA_WITH_AES_128_SHA
[00FF] TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Compression:
[00] NO_COMPRESSION
HTTP/1.1 200 Connection Established
FiddlerGateway: Direct
StartTime: 12:13:27.557
Connection: close
------------------------------------------------------------------
CONNECT bolt.dropbox.com:443 HTTP/1.1
Host: bolt.dropbox.com
Connection: keep-alive
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.3 (TLS/1.2)
Random: 90 58 67 E4 BD 39 01 C6 10 B4 B5 42 06 28 E5 D9 A5 59 2B 81 D3 4E FF D7 CD 78 EE A1 68 D8 7D 14
"Time": 6/6/2091 10:22:08 AM
SessionID: empty
Extensions:
server_name bolt.dropbox.com
ec_point_formats uncompressed [0x0], ansiX962_compressed_prime [0x1], ansiX962_compressed_char2 [0x2]
elliptic_curves secp256r1 [0x17], secp521r1 [0x19], unknown [0x1C), unknown [0x1B), secp384r1 [0x18], unknown [0x1A), secp256k1 [0x16], sect571r1 [0xE], sect571k1 [0xD], sect409k1 [0xB], sect409r1 [0xC], sect283k1 [0x9], sect283r1 [0xA]
SessionTicket empty
signature_algs sha512_rsa, sha512_dsa, sha512_ecdsa, sha384_rsa, sha384_dsa, sha384_ecdsa, sha256_rsa, sha256_dsa, sha256_ecdsa, sha224_rsa, sha224_dsa, sha224_ecdsa, sha1_rsa, sha1_dsa, sha1_ecdsa
Ciphers:
[C030] TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[C028] TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
[C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
[C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[C027] TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
[C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
[009F] TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
[006B] TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
[0039] TLS_DHE_RSA_WITH_AES_256_SHA
[009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
[0067] TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
[0033] TLS_DHE_RSA_WITH_AES_128_SHA
[00FF] TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Compression:
[00] NO_COMPRESSION
HTTP/1.1 200 Connection Established
FiddlerGateway: Direct
StartTime: 12:13:30.081
Connection: close
------------------------------------------------------------------
CONNECT bolt.dropbox.com:443 HTTP/1.1
Host: bolt.dropbox.com
Connection: keep-alive
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.3 (TLS/1.2)
Random: 9D 57 4A 23 D6 20 DA 4C 2F 99 EF AC A9 CA A3 DB 40 9D 3A A9 7A 2F DF AA 8B F2 CE FB E3 33 C9 68
"Time": 10/5/1988 1:10:53 PM
SessionID: empty
Extensions:
server_name bolt.dropbox.com
ec_point_formats uncompressed [0x0], ansiX962_compressed_prime [0x1], ansiX962_compressed_char2 [0x2]
elliptic_curves secp256r1 [0x17], secp521r1 [0x19], unknown [0x1C), unknown [0x1B), secp384r1 [0x18], unknown [0x1A), secp256k1 [0x16], sect571r1 [0xE], sect571k1 [0xD], sect409k1 [0xB], sect409r1 [0xC], sect283k1 [0x9], sect283r1 [0xA]
SessionTicket empty
signature_algs sha512_rsa, sha512_dsa, sha512_ecdsa, sha384_rsa, sha384_dsa, sha384_ecdsa, sha256_rsa, sha256_dsa, sha256_ecdsa, sha224_rsa, sha224_dsa, sha224_ecdsa, sha1_rsa, sha1_dsa, sha1_ecdsa
Ciphers:
[C030] TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[C028] TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
[C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
[C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[C027] TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
[C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
[009F] TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
[006B] TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
[0039] TLS_DHE_RSA_WITH_AES_256_SHA
[009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
[0067] TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
[0033] TLS_DHE_RSA_WITH_AES_128_SHA
[00FF] TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Compression:
[00] NO_COMPRESSION
HTTP/1.1 200 Connection Established
FiddlerGateway: Direct
StartTime: 12:13:34.502
Connection: close
------------------------------------------------------------------
CONNECT bolt.dropbox.com:443 HTTP/1.1
Host: bolt.dropbox.com
Connection: keep-alive
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.3 (TLS/1.2)
Random: BA C5 92 CA E0 B3 F3 27 C1 31 97 5A 50 76 54 7B AE 7E BA 25 1A 5A 92 07 57 FE 5C 2F 16 EE F0 2E
"Time": 9/11/2077 4:08:26 PM
SessionID: empty
Extensions:
server_name bolt.dropbox.com
ec_point_formats uncompressed [0x0], ansiX962_compressed_prime [0x1], ansiX962_compressed_char2 [0x2]
elliptic_curves secp256r1 [0x17], secp521r1 [0x19], unknown [0x1C), unknown [0x1B), secp384r1 [0x18], unknown [0x1A), secp256k1 [0x16], sect571r1 [0xE], sect571k1 [0xD], sect409k1 [0xB], sect409r1 [0xC], sect283k1 [0x9], sect283r1 [0xA]
SessionTicket empty
signature_algs sha512_rsa, sha512_dsa, sha512_ecdsa, sha384_rsa, sha384_dsa, sha384_ecdsa, sha256_rsa, sha256_dsa, sha256_ecdsa, sha224_rsa, sha224_dsa, sha224_ecdsa, sha1_rsa, sha1_dsa, sha1_ecdsa
Ciphers:
[C030] TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[C028] TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
[C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
[C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[C027] TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
[C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
[009F] TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
[006B] TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
[0039] TLS_DHE_RSA_WITH_AES_256_SHA
[009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
[0067] TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
[0033] TLS_DHE_RSA_WITH_AES_128_SHA
[00FF] TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Compression:
[00] NO_COMPRESSION
HTTP/1.1 200 Connection Established
FiddlerGateway: Direct
StartTime: 12:13:43.487
Connection: close
------------------------------------------------------------------
CONNECT shop.playrohan.com:443 HTTP/1.0
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Creative AutoUpdate v1.41.09)
Content-Length: 0
Host: shop.playrohan.com
Connection: Keep-Alive
Pragma: no-cache
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.3 (TLS/1.2)
Random: 59 C3 E5 3D B7 2E 91 23 6E AD 08 92 D2 33 71 F8 4C 24 B1 E8 41 89 B2 19 DE 7B 6B AF B9 89 1C DA
"Time": 11/28/2002 2:18:49 AM
SessionID: empty
Extensions:
server_name shop.playrohan.com
status_request OCSP - Implicit Responder
elliptic_curves unknown [0x1D), secp256r1 [0x17], secp384r1 [0x18]
ec_point_formats uncompressed [0x0]
signature_algs sha256_rsa, sha384_rsa, sha1_rsa, sha256_ecdsa, sha384_ecdsa, sha1_ecdsa, sha1_dsa, sha512_rsa, sha512_ecdsa
SessionTicket empty
extended_master_secret empty
renegotiation_info 00
Ciphers:
[C02C] TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
[C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
[C030] TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[C024] TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
[C023] TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
[C028] TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
[C027] TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
[C00A] TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
[C009] TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
[C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
[C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
[009D] TLS_RSA_WITH_AES_256_GCM_SHA384
[009C] TLS_RSA_WITH_AES_128_GCM_SHA256
[003D] TLS_RSA_WITH_AES_256_CBC_SHA256
[003C] TLS_RSA_WITH_AES_128_CBC_SHA256
[0035] TLS_RSA_AES_256_SHA
[002F] TLS_RSA_AES_128_SHA
[000A] SSL_RSA_WITH_3DES_EDE_SHA
Compression:
[00] NO_COMPRESSION
HTTP/1.0 200 Connection Established
FiddlerGateway: Direct
StartTime: 12:13:49.519
Connection: close
Encrypted HTTPS traffic flows through this CONNECT tunnel. HTTPS Decryption is enabled in Fiddler, so decrypted sessions running in this tunnel will be shown in the Web Sessions list.
Secure Protocol: Tls
Cipher: Aes256 256bits
Hash Algorithm: Sha1 160bits
Key Exchange: ECDHE_RSA (0xae06) 384bits
== Server Certificate ==========
[Subject]
CN=*.playrohan.com, OU=PremiumSSL Wildcard, O=Playwith Interactive Inc, STREET=9090 Irvine Center DR, STREET=Suite 100, L=Irvine, S=CA, PostalCode=92618, C=US
[Issuer]
CN=COMODO RSA Organization Validation Secure Server CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
[Serial Number]
6F9BDDDB5D9473E185E97251E2D7E95E
[Not Before]
12/16/2015 7:00:00 PM
[Not After]
2/21/2018 6:59:59 PM
[Thumbprint]
46F0EB5CF11E92A25CFD614DD82529656493E1F9
[SubjectAltNames]
*.playrohan.com, playrohan.com
------------------------------------------------------------------
GET

HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Creative AutoUpdate v1.41.09)
Host: shop.playrohan.com
Connection: Keep-Alive
Cookie: _ga=GA1.2.1557899702.1493485719
HTTP/1.1 302 Object moved
Cache-Control: no-cache,must-revalidate,private
Pragma: no-cache
Content-Length: 283
Content-Type: text/html;charset=UTF-8
Expires: Thu, 21 Sep 2017 16:13:49 GMT
Location:

Server: Microsoft-IIS/7.0
Set-Cookie: R%5Fcon=cookiesS=343339393039323837; domain=playrohan.com; path=/
Set-Cookie: ASPSESSIONIDSEBSCCRQ=HKLHIDKBBHLHJIDEJEJOILFP; secure; path=/
X-Powered-By: ASP.NET
Date: Thu, 21 Sep 2017 16:13:49 GMT
<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="https://portal.playrohan.com/Login/Login.process_Game.html?userid=panamajoe&userip=## .##.##.##&usersession=D4DBE45F-9F45-4115-9196-98BA6F6A4C73&game=">here</a>.</body>
------------------------------------------------------------------
CONNECT portal.playrohan.com:443 HTTP/1.0
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Creative AutoUpdate v1.41.09)
Host: portal.playrohan.com:443
Content-Length: 0
Connection: Keep-Alive
Pragma: no-cache
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.3 (TLS/1.2)
Random: 59 C3 E5 3E C8 DC 0B 49 FD D4 8A 54 B0 2E 70 0F B5 0D CC A2 5D 20 C2 B4 AF 78 B8 CA 99 6D 18 EB
"Time": 6/10/2003 7:39:05 AM
SessionID: empty
Extensions:
server_name portal.playrohan.com
status_request OCSP - Implicit Responder
elliptic_curves unknown [0x1D), secp256r1 [0x17], secp384r1 [0x18]
ec_point_formats uncompressed [0x0]
signature_algs sha256_rsa, sha384_rsa, sha1_rsa, sha256_ecdsa, sha384_ecdsa, sha1_ecdsa, sha1_dsa, sha512_rsa, sha512_ecdsa
SessionTicket empty
extended_master_secret empty
renegotiation_info 00
Ciphers:
[C02C] TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
[C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
[C030] TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[C024] TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
[C023] TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
[C028] TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
[C027] TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
[C00A] TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
[C009] TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
[C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
[C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
[009D] TLS_RSA_WITH_AES_256_GCM_SHA384
[009C] TLS_RSA_WITH_AES_128_GCM_SHA256
[003D] TLS_RSA_WITH_AES_256_CBC_SHA256
[003C] TLS_RSA_WITH_AES_128_CBC_SHA256
[0035] TLS_RSA_AES_256_SHA
[002F] TLS_RSA_AES_128_SHA
[000A] SSL_RSA_WITH_3DES_EDE_SHA
Compression:
[00] NO_COMPRESSION
HTTP/1.0 200 Connection Established
FiddlerGateway: Direct
StartTime: 12:13:50.156
Connection: close
Encrypted HTTPS traffic flows through this CONNECT tunnel. HTTPS Decryption is enabled in Fiddler, so decrypted sessions running in this tunnel will be shown in the Web Sessions list.
Secure Protocol: Tls
Cipher: Aes256 256bits
Hash Algorithm: Sha1 160bits
Key Exchange: ECDHE_RSA (0xae06) 384bits
== Server Certificate ==========
[Subject]
CN=*.playrohan.com, OU=PremiumSSL Wildcard, O=Playwith Interactive Inc, STREET=9090 Irvine Center DR, STREET=Suite 100, L=Irvine, S=CA, PostalCode=92618, C=US
[Issuer]
CN=COMODO RSA Organization Validation Secure Server CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
[Serial Number]
6F9BDDDB5D9473E185E97251E2D7E95E
[Not Before]
12/16/2015 7:00:00 PM
[Not After]
2/21/2018 6:59:59 PM
[Thumbprint]
46F0EB5CF11E92A25CFD614DD82529656493E1F9
[SubjectAltNames]
*.playrohan.com, playrohan.com
------------------------------------------------------------------
GET

HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Creative AutoUpdate v1.41.09)
Connection: Keep-Alive
Host: portal.playrohan.com
Cookie: _ga=GA1.2.1557899702.1493485719; R%5Fcon=cookiesS=343339393039323837
HTTP/1.1 302 Object moved
Cache-Control: no-cache,must-revalidate,private
Pragma: no-cache
Content-Length: 188
Content-Type: text/html;charset=UTF-8
Expires: Thu, 21 Sep 2017 16:12:50 GMT
Location:

Server: Microsoft-IIS/7.0
Set-Cookie: ASPSESSIONIDQGAQABTR=JBPDIDKBPCIBCMBNOCNHEJNE; secure; path=/
X-Powered-By: ASP.NET
Date: Thu, 21 Sep 2017 16:13:49 GMT
<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="https://shop.playrohan.com/ItemMall/Game_Call.html?returnCode=-8002">here</a>.</body>
------------------------------------------------------------------
GET

HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Creative AutoUpdate v1.41.09)
Connection: Keep-Alive
Host: shop.playrohan.com
Cookie: _ga=GA1.2.1557899702.1493485719; R%5Fcon=cookiesS=343339393039323837; ASPSESSIONIDSEBSCCRQ=HKLHIDKBBHLHJIDEJEJOILFP
HTTP/1.1 200 OK
Cache-Control: no-cache,must-revalidate,private
Pragma: no-cache
Content-Length: 35
Content-Type: text/html;charset=UTF-8
Expires: Thu, 21 Sep 2017 16:13:50 GMT
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Thu, 21 Sep 2017 16:13:49 GMT
Check User Ip or Game Session value
------------------------------------------------------------------