Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In my pentesting lab I'm using ettercap for do a mitm to a XP VM.

I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like pentest/pentestpasswd try to login and stop the sniffer.

In this moment, ettercap shows that user/password stolen. I'm trying to find that info in Wireshark too, but I can't. Even following the TCP stream, I can't.

Some advice?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

you wont be able to see it plain text in wireshark. the packets are encrypted ettercap is acting as a relay, your pc connects to ettercap which decrypts the login info then encrypts it again to send it to the real gmail server

share|improve this answer
Ah ok, I was thinking that ettercap sent them decrypted. –  yzT Dec 24 '12 at 21:24
If im not mistaken Max you are referring to the need to do a SSL strip. –  Oscalation Dec 26 '12 at 5:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.