If a site is enforcing HSTS, does that prevent packet capturing of a GET requests in Wireshark?
If it prevents it, is it possible to achieve the same using Bettercap or any other alternatives?
Scenario:
The response to the GET request is a token value, which is sensitive and can be used for other functionalities on the website.
Let's back up a bit because you are asking about details on the extreme ends of a technology stack and your question misses the mark and doesn't make sense.
So, would TLS prevent the contents of a GET request from being exposed? Yes.
What about Bettercap?
But that's just one attack. Another, better, use of Bettercap is to replace the certificate of the server with its own and decrypt the client communication. HSTS will not be so useful against that.
Packet capturing happens at the network level. Since the browser has to send out network packets to fetch a site for you, you can always capture the network packets. HSTS has no impact on this process at all.
What HSTS does is help the browser decide whether or not it MUST use HTTPS instead of HTTP. If the browser decides to use HTTPS then of course the data in the packets will be encrypted, so while you can still capture the packets, you won't be able to read their contents.
Of course you could get around that locally by using a proxy to intercept all your network traffic, and add its root certificate to your certificate store. As long as the application/website isn't using public key pinning you will be able to intercept and decrypt the traffic so you can read it. Of course we're talking about your own browser here so you could have done this just as easily in your browser's network tab.
Remember though that all of the above is difficult or impossible to do on someone else's machine, so none of this will help you to extract a token in a GET request from someone else.
