removed thanks and reformat the question

Source Link

edit approved Dec 24, 2016 at 23:16

152
2
11

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, then I opened up the App on my iPhone and started to sniff some traffic.

I pressed the "login" button and this happened.:

enter image description here Burp Suite

My username and my password are there, in plaintext. The connection is actually httpsHTTPS, but if it's httpsHTTPS, why can I read my username and password as plaintext parameters in the POST request?

Is this normal?

I also tried to replicate the login process with thea curl command, and it works only if iI use the -k parameter that skip the SSL certificate validation.

What's going on here?

Thank you :)

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" button and this happened.

enter image description here

My username and my password are there, in plaintext. The connection is actually https, but if it's https, why can I read my username and password as plaintext parameters in the POST request? Is this normal?

I also tried to replicate the login with the curl command, and it works only if i use the -k parameter that skip the SSL certificate validation.

What's going on here?

Thank you :)

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, then I opened up the App on my iPhone and started to sniff some traffic.

I pressed the "login" button and this happened:

Burp Suite

My username and my password are there, in plaintext. The connection is actually HTTPS, but if it's HTTPS, why can I read my username and password as plaintext parameters in the POST request?

Is this normal?

I also tried to replicate the login process with a curl command, and it works only if I use the -k parameter that skip the SSL certificate validation.

What's going on here?

Tweeted twitter.com/#!/StackSecurity/status/517111693777068032

occurred Oct 1, 2014 at 0:40

fixed small formatting things

Source Link

edit approved Sep 30, 2014 at 10:13

Lighty

2.4k
1
26
36

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" button and this happened.

enter image description here

My username and my password are there. In, in plaintext. The The connection is actually https, but if it's https, why can I read my username and password as plaintext parameters in the POST request? Is this normal?

I also tried to replicate the login with the curl command, and it works only if i use the "-k"-k parameter that skip the SSL certificate validation.

What's going on here?

Thank you :)

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" button and this happened. enter image description here

My username and my password are there. In plaintext. The connection is actually https, but if it's https, why can I read my username and password as plaintext parameters in the POST request? Is this normal? I also tried to replicate the login with the curl command, and it works only if i use the "-k" parameter that skip the SSL certificate validation.

What's going on here?

Thank you :)

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" button and this happened.

enter image description here

My username and my password are there, in plaintext. The connection is actually https, but if it's https, why can I read my username and password as plaintext parameters in the POST request? Is this normal?

I also tried to replicate the login with the curl command, and it works only if i use the -k parameter that skip the SSL certificate validation.

What's going on here?

Thank you :)

Source Link

asked Sep 30, 2014 at 9:45

marcomanzoni

383
3
7

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" button and this happened. enter image description here

My username and my password are there. In plaintext. The connection is actually https, but if it's https, why can I read my username and password as plaintext parameters in the POST request? Is this normal? I also tried to replicate the login with the curl command, and it works only if i use the "-k" parameter that skip the SSL certificate validation.

What's going on here?

Thank you :)

Stack Exchange Network

Return to Question

Passwords in plaintext?