In my pentesting lab I'm using ettercap for do a mitm to a XP VM.
I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like pentest/pentestpasswd try to login and stop the sniffer.
In this moment, ettercap shows that user/password stolen. I'm trying to find that info in Wireshark too, but I can't. Even following the TCP stream, I can't.