I am trying to see if a webapp transmit password in some form of cleartext. The problem is that the web app is NOT using https! This is why I wondering is my passwords is sent in clear text.
I've found a cookie in my browser containing the following :
From what I can tell, usr is my user name, and mdp ("mot de passe" in french means password).
So, is the mdp field of the cookie my password (and, if it's the case, how could I "decrypt" it ?), or just some kind of token? The password is 7 chars long.
I tried to convert it from hex or from base 64, but no luck.
EDIT: Included statement that HTTPS is not being used.
EDIT2 : The website is a webstite for students. Passwords are given by the school at the beginning of the year. We can't change them.
I suspect that some students are ARP'ing the school network. I try to disconnect as fast as possible from the website to invalidate the cookies, but I wanted to know if they can find the password from the cookie.