1

I would like to know if the credentials can be intercepted/MitM attack if the site is using HTTP to HTTPS login iframe.

Here are some login details from my Chrome dev tools (Form Data)

So I can see the credentials on my Chrome but I cant see on the Wireshark and can I capture this on Burp?

Cache-Control:private
Content-Length:141
Content-Type:text/html; charset=utf-8
Location:/mobile/account.aspx
p3p:CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server:Microsoft-IIS/7.0

FbAccessToken:
ctl00$initfvk1$AccessTokenHiddenField:
ctl00$cph1$LoginForm$UserName:[email protected]
ctl00$cph1$LoginForm$Password:password123
Improve this question

2 Answers 2

Reset to default
3

... if the site is using HTTP to HTTPS login iframe.

If I understand you right then you mean that the login frame is loaded via HTTP, but the results are send via HTTPS. In this case a passive MITM attack (i.e. sniffing only) can not be used to sniff the credentials because they are sent with HTTPS. But an active attack like sslstrip can still be used because it can change the target of the login form and thus make it sent the data in plain.

Improve this answer
8
  • So why I can see credentials on my Chrome Dev Tools (Form Data)?
    – Michal Koczwara
    Commented Jan 4, 2016 at 13:23
  • 1
    @MichalKoczwara: Because the browser has of course access to the values before they get encrypted.
    – Steffen Ullrich
    Commented Jan 4, 2016 at 14:51
  • Yes I understand but I compared my site to another site and I can intercept credentials (login and password) with Chrome Dev Tools on my site (HTTP to iframe HTTPS) and I cant see credentials on other site login page (HTTPS). So why this is happen ?
    – Michal Koczwara
    Commented Jan 4, 2016 at 14:56
  • 1
    @MichalKoczwara: The browser does not know anything about what is your site and what is not your site so it must be something specific to this other site. But I'm not able to get more into the details unless I know which other site your are talking about exactly and what you have tried.
    – Steffen Ullrich
    Commented Jan 4, 2016 at 14:59
  • Ok please for example try to intercept with Chrome Dev Tools /Network login and password on appleid.apple.com site.
    – Michal Koczwara
    Commented Jan 4, 2016 at 15:01
2

As long as the login iframe uses SSL/TLS, the data sent using that form are safe. The reason you can see the data in your browser's Dev Tools is that since the browser is the endpoint in the communication, your browser is able to see the data that is being sent in the underlying HTTP requests.

Please note though that in your scenario, the user is still vulnerable to an active Man-in-the-Middle attack in the sense that the main page is not secured over SSL/TLS and therefore the url of the iframe could be modified. As explained above, a passive Man-in-the-Middle attack is not possible in your scenario.

Improve this answer
2
  • Well I just compared my site to another site and I can intercept credentials (login and password) with Chrome Dev Tools on my site (HTTP to iframe HTTPS) and I cant see credentials on other site login page (HTTPS). So why this is happen ?
    – Michal Koczwara
    Commented Jan 4, 2016 at 14:24
  • 1
    When using Firefox, select the Network tab in Dev Tools. Try appleid.apple.com or login.live.com and try to log in. Select the entry in the left pane of Dev Tools that uses the POST method. Select the Pararms tab in the right pane to see the original username and password sent in the HTTP request. Thus, although the request was sent over TLS, the original request is still visible in the browser.
    – Wietze
    Commented Jan 4, 2016 at 15:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .