I am trying to see if a webapp transmit password in some form of cleartext. The problem is that the web app is NOT using https! This is why I wondering is my passwords is sent in clear text.
I've found a cookie in my browser containing the following :
usr=waytodoor&mdp=3C5115ECB18725EBFFF4BB11F9D17798358477D6E11E0188D54BAB80C86D38D41A16F76D8D0B253445774484FB1AE22E9FC13E257CFB9E7B7466F1BA5417EA004FCBB4E7965CA571819146A148EED15A2AEA6E47D9DF338B534264FBC99A57952212629BA79BB34BE9C8C60B73F1F681EE872C64
From what I can tell, usr is my user name, and mdp ("mot de passe" in french means password).
So, is the mdp field of the cookie my password (and, if it's the case, how could I "decrypt" it ?), or just some kind of token? The password is 7 chars long.
I tried to convert it from hex or from base 64, but no luck.
EDIT: Included statement that HTTPS is not being used.
EDIT2 : The website is a webstite for students. Passwords are given by the school at the beginning of the year. We can't change them.
I suspect that some students are ARP'ing the school network. I try to disconnect as fast as possible from the website to invalidate the cookies, but I wanted to know if they can find the password from the cookie.
usr
cookie together with the other user'smdp
cookie. If that works, they're doing something weird. – CodesInChaos May 12 '16 at 14:03