Of course you can steal the data!
This becomes apparent when you consider how a network works and the attacks that you could perform within a network. The following are two very basic examples:
- ARP Poisoning/Spoofing
- Simply control the physical network infrastructure (router)
With ARP Poisoning/Spoofing, you basically broadcast a message to the network saying "I am the router!" and the other devices on the network reply "Yes, master, I shall send all of my data to you." Then all the devices on the network will route any kind of web request they make through you. Thus, this allows you to take control of the network and intercept data. (MiTM Attack. Note: nowadays there are protections in place to prevent this kind of attack, but it can still be done.)
Controlling the Physical Network: If you control the physical network infrastructure, then it is basically game over for anyone on the network. This is achieved by bringing a router with you, making a network called "Totally fun, safe, and free wifi network with no data logging or hacking...", and then leaching all data, probably via routing the data through a device you have connected to the router. (Again, this is a MiTM attack.)
But how do I get the encrypted data? you ask. Well, that isn't too hard actually. First, we will need to forge a certificate. Okay, that part might be a bit hard, but as it turns out, there are a couple ways we can do this:
- Convince the user to install a custom SSL/TLS Root Certificate, thus allowing your MiTM system to act as a certificate authority to issue certificates for any website the user visits. (Kind of messy and requires the user to install the vulnerability.);
- Many browsers, especially older browsers, are vulnerable to a null-byte exploit that I first heard about in a presentation given by a researcher/hacker who goes by Moxie Marlinspike. Essentially, a lot of Certificate Authorities use Pascal-style strings (fixed-width) in their systems, but most browsers use C-style strings (null-termianted). So, a certificate like
*\0.a-domain-name-you-own.com would actually allow you to match any website. (In many browsers
* says "match anything" and
\0 says "matching ends here".) So, good game, a certificate for this domain would match literally any website and it could be handed out to any client on the network that you are performing a MiTM with; or
- Attempt to do SSL-Stripping. (Does not work on most modern websites, so I won't bother discussing this one. Also does not require certificate forging.)
Option 1 is pretty self explanatory, so I'll go into option 2 a bit more. Browsers use a protocol called OCSP to determine if a certificate is still valid or not. So, this is a major problem if the certificate authority revokes the certificate you created for
*\0.a-domain-name-you-own.com. Interestingly enough, though, the response from the OCSP protocol will return a message containing a byte indicating the certificates status, and an optional signed message describing the status code. Options 0-2 require the signed message describing the status code, where option 0 is "Success" (certificate is still valid), option 1 is "Malformed Request", and option 2 is "Internal Error". Status code 3, however, does not require a signed message describing it, and a status code of 3 actually means "Try Later." Many older browsers (with old implementations of SSL) will interpret this as basically being equivalent to "Success", and the certificate will be treated as valid. Thus, you can MiTM the HTTPS (SSL/TLS) encrypted content being transmitted between the client on the browser for ANY website.
For more details on that, I would recommend watching the following talk by Moxie Marlynspike at DEFCON 17: https://www.youtube.com/watch?v=ibF36Yyeehw
It is important to note that the method described for Option 2 (Asteriks and null-terminator exploit) is a somewhat old method now which might not work any more for most browsers. However, this should still give you an interesting study into how HTTPS and SSL/TLS can be exploited, decrypted, modified, and monitored.
It is also worth mentioning that you could use other attack vectors to get the data. One that comes to mind immediately, if you're on the same network, is the option to scan the other devices on the network for vulnerabilities and then hack them to execute some code on the device. (E.g., create a reverse shell.) I would recommend looking into Metasploit if you want to learn more about that, as it is out of the scope of this answer, and this answer is long enough as is ;-)
Disclaimer: I am also a Computer Science student, so I am by no means a professional in the field. As such, there could be a few incorrect details above. Regardless, hopefully this will help to answer your questions, and it might even spark some interest in you to research a few things mentioned.