Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my pentesting lab I'm using ettercap for do a mitm to a XP VM.

I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like pentest/pentestpasswd try to login and stop the sniffer.

In this moment, ettercap shows that user/password stolen. I'm trying to find that info in Wireshark too, but I can't. Even following the TCP stream, I can't.

Some advice?

share|improve this question
up vote 3 down vote accepted

you wont be able to see it plain text in wireshark. the packets are encrypted ettercap is acting as a relay, your pc connects to ettercap which decrypts the login info then encrypts it again to send it to the real gmail server

share|improve this answer
Ah ok, I was thinking that ettercap sent them decrypted. – Ayozint Dec 24 '12 at 21:24
If im not mistaken Max you are referring to the need to do a SSL strip. – Oscalation Dec 26 '12 at 5:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.