4

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security features like this?

Improve this question

1 Answer 1

Reset to default
4

A browser should do it. If the login page is HTTP rather than HTTPS, then you already have a problem as even if the credentials are supposed to be passed over HTTPS, an active attacker could modify the login page to change the action, or perform other additional malicious actions.

To determine if even in the designed state credentials are being passed in the clear, just view the source of the login page in the browser. If the login form action is HTTP://, or if the login page is HTTP and the action is relative or schemeless, (relative looks like action="/process-login" and schemeless looks like action="//insecuresite.com/process-login") then credentials are indeed being passed in the clear.

You can also use the "Network" tab (or equivalent) in your chosen browser's developer tools, often accessed via F12 to examine the actual request to determine if it is HTTP or HTTPS.

Improve this answer
3
  • I'm not very familiar with web code but the site in question is haywardomnilogic.com/Login.aspx - it does appear to just use ./Login.aspx as the action.
    – Enigma
    Mar 14, 2016 at 15:33
  • 1
    @Enigma Yes, you're correct. It is passing credentials in cleartext over HTTP.
    – Xander
    Mar 14, 2016 at 15:35
  • 1
    @Enigma - The login credentials at that site are POSTed in plaintext over HTTP.
    – dr jimbob
    Mar 14, 2016 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .